Add Clay agent interface, fix registry UI routing, and misc improvements

- Deploy Clay (claude Code web UI) at agent.ladkau.de behind basic auth;
  Traefik proxies to clay's HTTPS port 2633 with insecureSkipVerify
- Document MCP server persistence: binaries need to be baked into the
  Dockerfile, config in /opt/clay/data survives rebuilds
- Document scheduled agent workflows via Gitea Actions on.schedule with
  email reporting via Gmail SMTP
- Fix registry UI: split /v2/ (registry) and / (UI) into separate Traefik
  routers; add registry_internal network
- Add weekly registry GC cron job (/usr/local/bin/registry-gc)
- Remove rate-limit middleware from Gitea router (act_runner polling
  exceeded 60 req/min limit)
- Set Traefik websecure readTimeout: 0 to fix large layer upload 499s

ansible/roles/clay/tasks/main.yml

@@ -0,0 +1,48 @@
+---
+- name: Create clay directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - "{{ clay_data_dir }}"
+    - "{{ clay_data_dir }}/data"
+    - "{{ clay_data_dir }}/workspace"
+  tags: clay
+
+- name: Deploy Dockerfile
+  ansible.builtin.copy:
+    src: Dockerfile
+    dest: "{{ clay_data_dir }}/Dockerfile"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Rebuild and restart clay
+  tags: clay
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ clay_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart clay
+  tags: clay
+
+- name: Build clay image
+  community.docker.docker_image:
+    name: clay:local
+    build:
+      path: "{{ clay_data_dir }}"
+    source: build
+    state: present
+  tags: clay
+
+- name: Start clay
+  community.docker.docker_compose_v2:
+    project_src: "{{ clay_data_dir }}"
+    state: present
+  tags: clay