feat: enable Watchtower HTTP API and use internal registry

- Add HTTP API to Watchtower for CI/CD triggered updates
- Update custom container images to use git.schweitz.internal
- Add GITEA_TOKEN env var to scheduler for release cleanup task

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

stacks/watchtower.yml

@@ -11,12 +11,20 @@ services:
     image: containrrr/watchtower:latest
     container_name: watchtower
     restart: unless-stopped
+    ports:
+      - "8070:8080"  # HTTP API for triggering updates
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
     environment:
       - WATCHTOWER_CLEANUP=true  # Remove old images after update
       - WATCHTOWER_SCHEDULE=0 0 4 * * *  # Run at 4 AM daily (cron format)
       - TZ=Europe/Amsterdam
+
+      # HTTP API for CI/CD triggered updates
+      - WATCHTOWER_HTTP_API_UPDATE=true
+      - WATCHTOWER_HTTP_API_TOKEN=${WATCHTOWER_API_TOKEN}
+      - WATCHTOWER_HTTP_API_PERIODIC_POLLS=true  # Allow triggering periodic poll via API
+
       # Optional: Enable notifications
       # - WATCHTOWER_NOTIFICATIONS=shoutrrr
       # - WATCHTOWER_NOTIFICATION_URL=  # Add notification URL (Discord, Slack, etc.)
@@ -45,6 +53,9 @@ networks:
 # Manual Trigger:
 # docker exec watchtower watchtower --run-once
 #
+# HTTP API Trigger (for CI/CD):
+# curl -H "Authorization: Bearer $WATCHTOWER_API_TOKEN" http://localhost:8070/v1/update
+#
 # Exclude Specific Containers:
 # Add label to container: com.centurylinklabs.watchtower.enable=false
 #
@@ -54,3 +65,6 @@ networks:
 # Security Note:
 # Watchtower has full Docker socket access. Review updates in logs.
 # Consider excluding critical services and updating them manually.
+#
+# Environment Variables (set in Portainer):
+# - WATCHTOWER_API_TOKEN: Secret token for HTTP API authentication