Add Clay agent interface, fix registry UI routing, and misc improvements

- Deploy Clay (claude Code web UI) at agent.ladkau.de behind basic auth;
  Traefik proxies to clay's HTTPS port 2633 with insecureSkipVerify
- Document MCP server persistence: binaries need to be baked into the
  Dockerfile, config in /opt/clay/data survives rebuilds
- Document scheduled agent workflows via Gitea Actions on.schedule with
  email reporting via Gmail SMTP
- Fix registry UI: split /v2/ (registry) and / (UI) into separate Traefik
  routers; add registry_internal network
- Add weekly registry GC cron job (/usr/local/bin/registry-gc)
- Remove rate-limit middleware from Gitea router (act_runner polling
  exceeded 60 req/min limit)
- Set Traefik websecure readTimeout: 0 to fix large layer upload 499s

docs/runbook-provisioning.md

@@ -81,6 +81,7 @@ Let's Encrypt certificates on first start and DNS must resolve at that point.
 | k8s.ladkau.de       | A → server IP |
 | vault.ladkau.de     | A → server IP |
 | dl.ladkau.de        | A → server IP |
+| agent.ladkau.de     | A → server IP |
 
 ### 4. Create the vault and populate secrets
 
@@ -121,6 +122,13 @@ registry_users:
   - username: alice
     password: "your-password"
 
+# Clay — Claude Code web interface at agent.ladkau.de
+# Generate API key at console.anthropic.com → API keys
+anthropic_api_key: ""
+clay_users:
+  - username: admin
+    password: "your-password"
+
 # Gitea Actions runners — token obtained after Gitea is running
 # See step 3.4 of runbook-configuration.md; replace after Gitea admin account is created
 gitea_runner_registration_token: "placeholder"
@@ -221,7 +229,8 @@ This runs all roles in order:
 | 10 | `k8s`         | Placeholder page at k8s.ladkau.de |
 | 11 | `vaultwarden` | Vaultwarden password vault at vault.ladkau.de |
 | 12 | `dl`          | Public download server at dl.ladkau.de — nginx HTTPS + SFTP upload |
-| 13 | `dashboard`   | Public status dashboard at cloud.ladkau.de — service health and server stats |
+| 13 | `clay`        | Claude Code web interface at agent.ladkau.de — basic auth, Anthropic API key required |
+| 14 | `dashboard`   | Public status dashboard at cloud.ladkau.de — service health and server stats |
 
 > **Note:** The `act_runner` role requires `gitea_runner_registration_token` in the
 > vault, which can only be obtained after Gitea is running and an admin account has