feat: pin ~28 images to specific versions, enable DIUN monitoring, add app-stacks pipeline

Pin third-party images from :latest to current stable versions:
- Platform: cloudflared, technitium, snmp-exporter, pve-exporter,
  headscale, shadowsocks, xray
- Apps: paperless-ngx, linkwarden, wealthfolio, speedtest, synapse,
  n8n, prowlarr, qbittorrent, lidarr, rybbit, ollama, immichframe,
  cyberchef, networking-toolbox, echo, coturn, shlink, affine

Enable DIUN annotations on all pinned deployments with per-image
tag patterns. Add Woodpecker app-stacks pipeline for selective
terragrunt apply on changed app stacks.

.woodpecker/app-stacks.yml

@@ -0,0 +1,122 @@
+when:
+  event: push
+  branch: master
+  # Only trigger when application stack files change
+  path:
+    include:
+      - 'stacks/**'
+    exclude:
+      - '.woodpecker/**'
+
+clone:
+  git:
+    image: woodpeckerci/plugin-git
+    settings:
+      attempts: 5
+      backoff: 10s
+
+steps:
+  - name: detect-changes
+    image: alpine
+    commands:
+      - apk add --no-cache git
+      # Detect which stacks changed in the latest commit
+      - |
+        CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null | grep '^stacks/' | cut -d/ -f2 | sort -u || true)
+        if [ -z "$CHANGED" ]; then
+          echo "No stack changes detected"
+          echo "" > .stacks_to_apply
+          exit 0
+        fi
+        # Exclude platform stacks (handled by default.yml)
+        PLATFORM="dbaas authentik crowdsec monitoring nvidia mailserver cloudflared kyverno metallb redis traefik technitium headscale rbac k8s-portal vaultwarden reverse-proxy metrics-server vpa nfs-csi iscsi-csi cnpg sealed-secrets uptime-kuma wireguard xray infra-maintenance platform vault reloader descheduler external-secrets"
+        APPLY=""
+        for stack in $CHANGED; do
+          if echo "$PLATFORM" | grep -qw "$stack"; then
+            echo "Skipping platform stack: $stack"
+            continue
+          fi
+          if [ ! -f "stacks/$stack/terragrunt.hcl" ]; then
+            echo "Skipping $stack (no terragrunt.hcl)"
+            continue
+          fi
+          APPLY="$APPLY $stack"
+        done
+        echo "$APPLY" > .stacks_to_apply
+        echo "Stacks to apply:$APPLY"
+
+  - name: prepare
+    image: alpine
+    commands:
+      - "apk update && apk add jq curl git git-crypt"
+      - |
+        curl -k https://10.0.20.100:6443/api/v1/namespaces/woodpecker/configmaps/git-crypt-key -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" | jq -r .data.key | base64 -d > /tmp/key
+      - "git-crypt unlock /tmp/key && rm /tmp/key"
+      - |
+        SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+        VAULT_TOKEN=$(curl -s -X POST http://vault-active.vault.svc.cluster.local:8200/v1/auth/kubernetes/login \
+          -d "{\"role\":\"ci\",\"jwt\":\"$SA_TOKEN\"}" | jq -r .auth.client_token)
+        echo "export VAULT_TOKEN=$VAULT_TOKEN" > .vault-env
+        echo "export VAULT_ADDR=http://vault-active.vault.svc.cluster.local:8200" >> .vault-env
+    when:
+      evaluate: 'CI_COMMIT_MESSAGE != "" && !contains(CI_COMMIT_MESSAGE, "[CI SKIP]")'
+
+  - name: terragrunt-apply
+    image: alpine
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 2Gi
+          limits:
+            memory: 4Gi
+    commands:
+      - "apk update && apk add curl unzip git openssh-client"
+      - "wget -qO /tmp/terraform.zip https://releases.hashicorp.com/terraform/1.5.7/terraform_1.5.7_linux_amd64.zip"
+      - "unzip -o /tmp/terraform.zip -d /usr/local/bin/ && chmod 755 /usr/local/bin/terraform"
+      - "wget -qO /usr/local/bin/terragrunt https://github.com/gruntwork-io/terragrunt/releases/download/v0.99.4/terragrunt_linux_amd64"
+      - "chmod 755 /usr/local/bin/terragrunt"
+      - "source .vault-env"
+      - |
+        STACKS=$(cat .stacks_to_apply)
+        if [ -z "$STACKS" ]; then
+          echo "No app stacks to apply"
+          exit 0
+        fi
+        FAILED=""
+        for stack in $STACKS; do
+          echo "=== Applying: $stack ==="
+          (cd stacks/$stack && terragrunt apply --non-interactive -auto-approve) &
+        done
+        wait
+    when:
+      evaluate: 'CI_COMMIT_MESSAGE != "" && !contains(CI_COMMIT_MESSAGE, "[CI SKIP]")'
+
+  - name: cleanup-and-push
+    image: alpine
+    commands:
+      - "rm -f .vault-env"
+      - "apk update && apk add openssh-client git git-crypt"
+      - "mkdir -p ~/.ssh && ssh-keyscan -H github.com >> ~/.ssh/known_hosts"
+      - "chmod 400 secrets/deploy_key"
+      - "git add stacks/ state/ .woodpecker/ || true"
+      - "git remote set-url origin git@github.com:ViktorBarzin/infra.git"
+      - "git commit -m 'Woodpecker CI app-stacks deploy commit [CI SKIP]' || echo 'No changes'"
+      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git pull --rebase origin master || true"
+      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git push origin master"
+    when:
+      status: [success, failure]
+
+  - name: slack
+    image: curlimages/curl
+    commands:
+      - |
+        STACKS=$(cat .stacks_to_apply 2>/dev/null || echo "none")
+        curl -s -X POST -H 'Content-type: application/json' \
+          --data "{\"channel\":\"general\",\"text\":\"Woodpecker CI: app-stacks pipeline ${CI_PIPELINE_STATUS} (stacks:${STACKS})\"}" \
+          "$SLACK_WEBHOOK" || true
+    environment:
+      SLACK_WEBHOOK:
+        from_secret: slack_webhook
+    when:
+      status: [success, failure]