feat: pin ~28 images to specific versions, enable DIUN monitoring, add app-stacks pipeline

Pin third-party images from :latest to current stable versions:
- Platform: cloudflared, technitium, snmp-exporter, pve-exporter,
  headscale, shadowsocks, xray
- Apps: paperless-ngx, linkwarden, wealthfolio, speedtest, synapse,
  n8n, prowlarr, qbittorrent, lidarr, rybbit, ollama, immichframe,
  cyberchef, networking-toolbox, echo, coturn, shlink, affine

Enable DIUN annotations on all pinned deployments with per-image
tag patterns. Add Woodpecker app-stacks pipeline for selective
terragrunt apply on changed app stacks.

stacks/platform/modules/xray/main.tf

@@ -80,10 +80,14 @@ resource "kubernetes_deployment" "xray" {
         labels = {
           app = "xray"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image             = "teddysun/xray"
+          image             = "teddysun/xray:26.3.27"
           name              = "xray"
           image_pull_policy = "IfNotPresent"
           port {