feat: pin ~28 images to specific versions, enable DIUN monitoring, add app-stacks pipeline

Pin third-party images from :latest to current stable versions:
- Platform: cloudflared, technitium, snmp-exporter, pve-exporter,
  headscale, shadowsocks, xray
- Apps: paperless-ngx, linkwarden, wealthfolio, speedtest, synapse,
  n8n, prowlarr, qbittorrent, lidarr, rybbit, ollama, immichframe,
  cyberchef, networking-toolbox, echo, coturn, shlink, affine

Enable DIUN annotations on all pinned deployments with per-image
tag patterns. Add Woodpecker app-stacks pipeline for selective
terragrunt apply on changed app stacks.

stacks/echo/main.tf

@@ -41,10 +41,14 @@ resource "kubernetes_deployment" "echo" {
         labels = {
           app = "echo"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+$"
+        }
       }
       spec {
         container {
-          image = "mendhak/http-https-echo"
+          image = "mendhak/http-https-echo:36"
           name  = "echo"
           port {
             container_port = 8080