feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

tests/compose_validity.bats

@@ -0,0 +1,48 @@
+#!/usr/bin/env bats
+# Seam: compose validity.
+# Every compose.yaml in the repo must parse as valid YAML and define services
+# with at least one image. This catches broken YAML, empty service maps, and
+# compose files that would fail `podman-compose config` on the target.
+
+load helpers
+
+@test "every compose.yaml parses as valid YAML" {
+    local found=0
+    while IFS= read -r f; do
+        found=1
+        yaml_parse_ok "$f"
+    done < <(find "$REPO_ROOT" -name 'compose.yaml' -not -path '*/.git/*' | sort)
+    [ "$found" -eq 1 ] || skip "no compose.yaml files found yet"
+}
+
+@test "every compose.yaml defines services with images" {
+    while IFS= read -r f; do
+        python3 - "$f" <<'PYEOF'
+import sys, yaml
+with open(sys.argv[1]) as fh:
+    data = yaml.safe_load(fh)
+services = (data or {}).get("services", {}) or {}
+assert services, f"{sys.argv[1]}: no services defined"
+for name, svc in services.items():
+    svc = svc or {}
+    assert svc.get("image"), f"{sys.argv[1]}: service '{name}' has no image"
+PYEOF
+    done < <(find "$REPO_ROOT" -name 'compose.yaml' -not -path '*/.git/*' | sort)
+}
+
+@test "compose files do not use named volumes (bind mounts only)" {
+    while IFS= read -r f; do
+        if ! python3 - "$f" <<'PYEOF'
+import sys, yaml
+with open(sys.argv[1]) as fh:
+    data = yaml.safe_load(fh)
+vols = ((data or {}).get("volumes", {}) or {})
+# exit 0 when there is no named-volumes section; exit 1 when there is
+sys.exit(1 if vols else 0)
+PYEOF
+        then
+            echo "compose file $f declares a named 'volumes:' section; policy is bind mounts only"
+            return 1
+        fi
+    done < <(find "$REPO_ROOT" -name 'compose.yaml' -not -path '*/.git/*' | sort)
+}