Add Clay agent interface, fix registry UI routing, and misc improvements

- Deploy Clay (claude Code web UI) at agent.ladkau.de behind basic auth;
  Traefik proxies to clay's HTTPS port 2633 with insecureSkipVerify
- Document MCP server persistence: binaries need to be baked into the
  Dockerfile, config in /opt/clay/data survives rebuilds
- Document scheduled agent workflows via Gitea Actions on.schedule with
  email reporting via Gmail SMTP
- Fix registry UI: split /v2/ (registry) and / (UI) into separate Traefik
  routers; add registry_internal network
- Add weekly registry GC cron job (/usr/local/bin/registry-gc)
- Remove rate-limit middleware from Gitea router (act_runner polling
  exceeded 60 req/min limit)
- Set Traefik websecure readTimeout: 0 to fix large layer upload 499s

ansible/group_vars/all/vars.yml

@@ -124,3 +124,13 @@ dl_sftp_port: 2223
 
 # Status dashboard (public — cloud.ladkau.de root)
 dashboard_data_dir: /opt/dashboard
+
+# Clay — Claude Code web interface (agent.ladkau.de)
+domain_clay: "agent.{{ domain_base }}"
+clay_data_dir: /opt/clay
+clay_users: []   # override in vault with [{username: ..., password: ...}]
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# anthropic_api_key: ""           # from console.anthropic.com → API keys
+# clay_users:
+#   - username: admin
+#     password: "your-password"