feat: pin ~28 images to specific versions, enable DIUN monitoring, add app-stacks pipeline

Pin third-party images from :latest to current stable versions:
- Platform: cloudflared, technitium, snmp-exporter, pve-exporter,
  headscale, shadowsocks, xray
- Apps: paperless-ngx, linkwarden, wealthfolio, speedtest, synapse,
  n8n, prowlarr, qbittorrent, lidarr, rybbit, ollama, immichframe,
  cyberchef, networking-toolbox, echo, coturn, shlink, affine

Enable DIUN annotations on all pinned deployments with per-image
tag patterns. Add Woodpecker app-stacks pipeline for selective
terragrunt apply on changed app stacks.

stacks/platform/modules/cloudflared/main.tf

@@ -45,6 +45,10 @@ resource "kubernetes_deployment" "cloudflared" {
         labels = {
           app = "cloudflared"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d{4}\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         topology_spread_constraint {
@@ -59,7 +63,7 @@ resource "kubernetes_deployment" "cloudflared" {
         }
         container {
           # image = "wisdomsky/cloudflared-web:latest"
-          image   = "cloudflare/cloudflared"
+          image   = "cloudflare/cloudflared:2026.3.0"
           name    = "cloudflared"
           command = ["cloudflared", "tunnel", "run"]
           env {