Add Clay agent interface, fix registry UI routing, and misc improvements

- Deploy Clay (claude Code web UI) at agent.ladkau.de behind basic auth;
  Traefik proxies to clay's HTTPS port 2633 with insecureSkipVerify
- Document MCP server persistence: binaries need to be baked into the
  Dockerfile, config in /opt/clay/data survives rebuilds
- Document scheduled agent workflows via Gitea Actions on.schedule with
  email reporting via Gmail SMTP
- Fix registry UI: split /v2/ (registry) and / (UI) into separate Traefik
  routers; add registry_internal network
- Add weekly registry GC cron job (/usr/local/bin/registry-gc)
- Remove rate-limit middleware from Gitea router (act_runner polling
  exceeded 60 req/min limit)
- Set Traefik websecure readTimeout: 0 to fix large layer upload 499s

scripts/check-services.sh

@@ -18,6 +18,7 @@ CHECKS=(
   "https://k8s.ladkau.de 200 10"
   "https://vault.ladkau.de 200 10"
   "https://dl.ladkau.de 200 10"
+  "https://agent.ladkau.de 401 10"
 )
 
 if ! command -v curl &>/dev/null; then

scripts/check-vault.sh

@@ -44,6 +44,7 @@ required_scalars = [
     "roundcube_db_password",
     "roundcube_des_key",
     "vaultwarden_admin_token",
+    "anthropic_api_key",
 ]
 
 # Required non-empty lists (must contain at least one entry)
@@ -51,6 +52,7 @@ required_lists = [
     "traefik_dashboard_users",
     "registry_users",
     "dovecot_users",
+    "clay_users",
 ]
 
 # Optional scalars: validated only when present — (key, validator_fn, hint)