refactor(compose): protect services and centralize routing

vikunja/docker-compose.yml

@@ -3,6 +3,8 @@ services:
     image: postgres:17-alpine
     container_name: vikunja-db
     restart: unless-stopped
+    labels:
+      prune.protect: "true"
     environment:
       TZ: ${TZ}
       POSTGRES_DB: ${VIKUNJA_DB_NAME}
@@ -20,8 +22,7 @@ services:
       - vikunja_internal
 
   vikunja:
-    image: vikunja/vikunja:latest
-    pull_policy: always
+    image: vikunja/vikunja@sha256:f6b80393c1998cd5cd0dc38d24762c59ab4c10000a6f1032ef5b554e262cab93
     container_name: vikunja
     restart: unless-stopped
     user: "1000:1000"
@@ -55,13 +56,9 @@ services:
       - mail_internal
       - proxy
     labels:
+      prune.protect: "true"
       traefik.enable: "true"
       traefik.docker.network: "proxy"
-      traefik.http.routers.vikunja.rule: "Host(`${VIKUNJA_DOMAIN}`)"
-      traefik.http.routers.vikunja.entrypoints: "websecure"
-      traefik.http.routers.vikunja.tls: "true"
-      traefik.http.routers.vikunja.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
-      traefik.http.services.vikunja.loadbalancer.server.port: "3456"
 
 networks:
   vikunja_internal: