feat(opencode): añadir stack del agente de código OpenCode

OpenCode como agente de desarrollo con acceso al filesystem del host,
expuesto vía Traefik con autenticación forward auth de Authentik.
Incluye configuración de systemd para modo web y ejemplos de .env.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

opencode/docker-compose.yml

@@ -0,0 +1,43 @@
+services:
+  opencode:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: local/opencode-sandbox:latest
+    container_name: opencode
+    restart: unless-stopped
+    stop_grace_period: 30s
+    user: "1000:1000"
+    command: ["web", "--hostname", "0.0.0.0", "--port", "4096"]
+    env_file:
+      - .env
+    environment:
+      HOME: /home/opencode
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /.local:size=128m,mode=1777
+      - /tmp:size=256m,mode=1777,exec
+    volumes:
+      - ${OPENCODE_HOME_PATH}:/home/opencode:Z
+      - ${OPENCODE_CONFIG_PATH}:/home/opencode/.config/opencode:Z
+      - ${OPENCODE_WORKSPACE_PATH}:/home/opencode/workspace:Z
+    working_dir: /home/opencode/workspace
+    networks:
+      - proxy
+    labels:
+      traefik.enable: "true"
+      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
+      traefik.http.routers.ocode.rule: "Host(`${OPENCODE_DOMAIN}`)"
+      traefik.http.routers.ocode.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
+      traefik.http.routers.ocode.tls: "true"
+      traefik.http.routers.ocode.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
+      traefik.http.routers.ocode.middlewares: "crowdsec-bouncer@file,${TRAEFIK_AUTH_CHAIN}"
+      traefik.http.services.ocode.loadbalancer.server.port: "4096"
+
+networks:
+  proxy:
+    external: true