Drop bundled Watchtower; rely on the host's global Watchtower

ripper already runs a single global nickfedor/watchtower (label-enabled) that watches every stack; the bundled containrrr/watchtower was redundant and crash-looped (its Docker API client is too old for Docker 29). Keep the watchtower.enable labels on backend/frontend so the host instance auto-deploys them; remove the per-stack service and profile.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

deploy/docker-compose.yml

@@ -108,20 +108,11 @@ services:
     profiles:
       - tunnel
 
-  # Auto-deploy: watch the label-enabled app containers (backend, frontend),
-  # poll the registry every 2 minutes, and recreate on a new :test-main digest.
-  # Scoped by label so it never touches Postgres/MinIO/Caddy. Registry creds come
-  # from the host docker config (the `docker login git.jpaul.io` on the host).
-  # Opt-in via the "watchtower" profile.
-  watchtower:
-    image: containrrr/watchtower:latest
-    restart: unless-stopped
-    command: --label-enable --cleanup --interval 120
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ${HOME:-/root}/.docker/config.json:/config.json:ro
-    profiles:
-      - watchtower
+# Auto-deploy is handled by the host's global Watchtower (a single
+# nickfedor/watchtower instance watches every container labelled
+# `com.centurylinklabs.watchtower.enable=true` across all stacks). The backend
+# and frontend carry that label above, so a new :test-main image is pulled and
+# the container recreated automatically — no per-stack Watchtower needed.
 
 volumes:
   pgdata: