feat: move n8n to dev stack under n8n.dev.pivoine.art

- Moved n8n service from standalone stack to dev/compose.yaml
- Updated hostname from n8n.pivoine.art to n8n.dev.pivoine.art
- Updated environment variables to use DEV_N8N_ prefix
- Updated restic backup volume reference (n8n_n8n_data -> dev_n8n_data)
- Removed standalone n8n/compose.yaml
- Container name changes from n8n_app to dev_n8n
- Volume name changes from n8n_n8n_data to dev_n8n_data

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

dev/compose.yaml

@@ -172,6 +172,60 @@ services:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}"
 
+  # n8n - Workflow automation platform
+  n8n:
+    image: ${DEV_N8N_IMAGE:-docker.n8n.io/n8nio/n8n}
+    container_name: ${DEV_COMPOSE_PROJECT_NAME}_n8n
+    restart: unless-stopped
+    volumes:
+      - n8n_data:/home/node/.n8n
+    environment:
+      TZ: ${TIMEZONE:-Europe/Berlin}
+      GENERIC_TIMEZONE: ${TIMEZONE:-Europe/Berlin}
+      N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: "true"
+      N8N_RUNNERS_ENABLED: "true"
+      DB_TYPE: postgresdb
+      DB_POSTGRESDB_DATABASE: ${DEV_N8N_DB_NAME}
+      DB_POSTGRESDB_HOST: ${CORE_DB_HOST}
+      DB_POSTGRESDB_PORT: ${CORE_DB_PORT}
+      DB_POSTGRESDB_USER: ${DB_USER}
+      DB_POSTGRESDB_PASSWORD: ${DB_PASSWORD}
+      DB_POSTGRESDB_SCHEMA: ${DEV_N8N_DB_SCHEMA:-public}
+      N8N_HOST: ${DEV_N8N_TRAEFIK_HOST}
+      N8N_PORT: 5678
+      N8N_PROTOCOL: https
+      WEBHOOK_URL: https://${DEV_N8N_TRAEFIK_HOST}/
+      N8N_EMAIL_MODE: smtp
+      N8N_SMTP_HOST: ${EMAIL_SMTP_HOST}
+      N8N_SMTP_PORT: ${EMAIL_SMTP_PORT}
+      N8N_SMTP_USER: ${EMAIL_SMTP_USER}
+      N8N_SMTP_PASS: ${EMAIL_SMTP_PASSWORD}
+      N8N_SMTP_SENDER: ${EMAIL_FROM}
+      N8N_SMTP_SSL: "true"
+      MATTERMOST_WEBHOOK_URL: ${MATTERMOST_WEBHOOK_URL:-}
+    depends_on:
+      - postgres
+    networks:
+      - compose_network
+    labels:
+      - "traefik.enable=${DEV_TRAEFIK_ENABLED}"
+      # HTTP to HTTPS redirect
+      - "traefik.http.middlewares.${DEV_COMPOSE_PROJECT_NAME}-n8n-redirect-web-secure.redirectscheme.scheme=https"
+      - "traefik.http.routers.${DEV_COMPOSE_PROJECT_NAME}-n8n-web.middlewares=${DEV_COMPOSE_PROJECT_NAME}-n8n-redirect-web-secure"
+      - "traefik.http.routers.${DEV_COMPOSE_PROJECT_NAME}-n8n-web.rule=Host(`${DEV_N8N_TRAEFIK_HOST}`)"
+      - "traefik.http.routers.${DEV_COMPOSE_PROJECT_NAME}-n8n-web.entrypoints=web"
+      # HTTPS router
+      - "traefik.http.routers.${DEV_COMPOSE_PROJECT_NAME}-n8n-web-secure.rule=Host(`${DEV_N8N_TRAEFIK_HOST}`)"
+      - "traefik.http.routers.${DEV_COMPOSE_PROJECT_NAME}-n8n-web-secure.tls.certresolver=resolver"
+      - "traefik.http.routers.${DEV_COMPOSE_PROJECT_NAME}-n8n-web-secure.entrypoints=web-secure"
+      - "traefik.http.middlewares.${DEV_COMPOSE_PROJECT_NAME}-n8n-web-secure-compress.compress=true"
+      - "traefik.http.routers.${DEV_COMPOSE_PROJECT_NAME}-n8n-web-secure.middlewares=${DEV_COMPOSE_PROJECT_NAME}-n8n-web-secure-compress,security-headers@file"
+      # Service
+      - "traefik.http.services.${DEV_COMPOSE_PROJECT_NAME}-n8n-web-secure.loadbalancer.server.port=5678"
+      - "traefik.docker.network=${NETWORK_NAME}"
+      # Watchtower
+      - "com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}"
+
 volumes:
   gitea_data:
     name: ${DEV_COMPOSE_PROJECT_NAME}_gitea_data
@@ -181,6 +235,8 @@ volumes:
     name: ${DEV_COMPOSE_PROJECT_NAME}_gitea_runner_data
   coolify_data:
     name: ${DEV_COMPOSE_PROJECT_NAME}_coolify_data
+  n8n_data:
+    name: ${DEV_COMPOSE_PROJECT_NAME}_n8n_data
 
 networks:
   compose_network: