feat: pin ~28 images to specific versions, enable DIUN monitoring, add app-stacks pipeline

Pin third-party images from :latest to current stable versions:
- Platform: cloudflared, technitium, snmp-exporter, pve-exporter,
  headscale, shadowsocks, xray
- Apps: paperless-ngx, linkwarden, wealthfolio, speedtest, synapse,
  n8n, prowlarr, qbittorrent, lidarr, rybbit, ollama, immichframe,
  cyberchef, networking-toolbox, echo, coturn, shlink, affine

Enable DIUN annotations on all pinned deployments with per-image
tag patterns. Add Woodpecker app-stacks pipeline for selective
terragrunt apply on changed app stacks.

stacks/servarr/lidarr/main.tf

@@ -43,10 +43,14 @@ resource "kubernetes_deployment" "lidarr" {
         labels = {
           app = "lidarr"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image = "lscr.io/linuxserver/lidarr:latest"
+          image = "lscr.io/linuxserver/lidarr:2.9.4"
           # image = "youegraillot/lidarr-on-steroids"
           name = "lidarr"
 

stacks/servarr/prowlarr/main.tf

@@ -72,10 +72,14 @@ resource "kubernetes_deployment" "prowlarr" {
         labels = {
           app = "prowlarr"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image = "lscr.io/linuxserver/prowlarr:latest"
+          image = "lscr.io/linuxserver/prowlarr:1.31.1"
           name  = "prowlarr"
 
           resources {

stacks/servarr/qbittorrent/main.tf

@@ -80,10 +80,14 @@ resource "kubernetes_deployment" "qbittorrent" {
         labels = {
           app = "qbittorrent"
         }
+        annotations = {
+          "diun.enable"       = "true"
+          "diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
+        }
       }
       spec {
         container {
-          image = "lscr.io/linuxserver/qbittorrent:latest"
+          image = "lscr.io/linuxserver/qbittorrent:5.0.4"
           name  = "qbittorrent"
 
           port {