Restructure compose mirror: stacks/ grouped by purpose, not by host

Replaces rocky-docker-lxc/, caddy-vm/, monitoring-vm/, and automation/
with a single stacks/ tree grouped by function (identity-and-security,
platform, media, productivity, dev-tools) - 55 stacks total, every one
a real directory in the private repos today.

Resolves all outstanding drift: adds Wazuh (previously entirely
missing), Firefly III and Postiz (never mirrored), the internal-zone
Caddy instance and the Cron Scheduler's separate NocoDB instance
(both previously conflated with their counterparts under one shared
folder); renames Calibre-Web to calibre-web-automated and splits
Kodi-MariaDB into kodi + mariadb-latest to match what the private
repos actually run now; drops the decommissioned NetBox stack.

Also removes automation/iac/old-content/ and
automation/ansible/old-playbooks/ in the same pass - both folders
were entirely stale content describing a superseded architecture
(GitLab instead of Gitea, HAProxy+mTLS SSO instead of the current
Caddy+Authentik setup), now replaced by docs/iac-pipeline.md.

stacks/productivity/ghost/docker-compose.yaml

@@ -0,0 +1,82 @@
+services:
+  ghost:
+    image: ghost:latest
+    container_name: ghost_blog
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT}:2368"
+    depends_on:
+      - ghost_db
+    environment:
+      NODE_ENV: production
+      TZ: ${TZ}
+      # Ghost URL
+      url: ${GHOST_URL}
+      # SMTP
+      mail__transport: ${SMTP_TRANSPORT}
+      mail__options__host: ${SMTP_HOST}
+      mail__options__port: ${SMTP_PORT}
+      mail__options__secure: "false"
+      mail__options__auth__user: ${SMTP_USER}
+      mail__options__auth__pass: ${SMTP_PASSWORD}
+      # Database
+      database__client: mysql
+      database__connection__host: ${DB_HOST}
+      database__connection__user: ${DB_USER}
+      database__connection__password: ${DB_PASSWORD}
+      database__connection__database: ${DB_NAME}
+    volumes:
+      - /path/to/ghost/content:/var/lib/ghost/content
+    networks:
+      - blog-net
+
+  ghost_db:
+    image: mysql:8
+    container_name: ghost_mysql
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
+      MYSQL_DATABASE: ${DB_NAME}
+      MYSQL_USER: ${DB_USER}
+      MYSQL_PASSWORD: ${DB_PASSWORD}
+    volumes:
+      - /path/to/ghost/db_data:/var/lib/mysql
+      - /path/to/ghost/init:/docker-entrypoint-initdb.d:ro
+    networks:
+      - blog-net
+
+  umami:
+    image: ghcr.io/umami-software/umami:postgresql-latest
+    container_name: umami_analytics
+    restart: unless-stopped
+    ports:
+      - "${UMAMI_PORT}:3000"
+    depends_on:
+      - umami-db
+    environment:
+      TZ: ${TZ}
+      DATABASE_URL: postgresql://${UMAMI_DB_USER}:${UMAMI_DB_PASSWORD}@umami-db:5432/${UMAMI_DB_NAME}
+      DATABASE_TYPE: postgresql
+      APP_SECRET: ${UMAMI_APP_SECRET}
+      IGNORE_IP: ${UMAMI_IGNORE_IP}
+    networks:
+      - blog-net
+
+  umami-db:
+    image: postgres:15-alpine
+    container_name: umami_postgres
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+      POSTGRES_DB: ${UMAMI_DB_NAME}
+      POSTGRES_USER: ${UMAMI_DB_USER}
+      POSTGRES_PASSWORD: ${UMAMI_DB_PASSWORD}
+    volumes:
+      - /path/to/umami/db_data:/var/lib/postgresql/data
+    networks:
+      - blog-net
+
+networks:
+  blog-net:
+    external: true