feat: enable Watchtower auto-updates for all application services

Add missing Watchtower labels to:
- net_umami: Analytics service
- dev_gitea_runner: CI/CD runner
- sexy_api: Directus CMS backend
- util_linkwarden_meilisearch: Search engine

All application services now have automatic updates enabled.
Critical infrastructure (postgres, redis, traefik) intentionally
excluded from auto-updates for stability.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

dev/compose.yaml

@@ -88,6 +88,9 @@ services:
       DOCKER_HOST: unix:///var/run/docker.sock
     networks:
       - compose_network
+    labels:
+      # Watchtower
+      - "com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}"
 
   # Coolify - Self-hosted deployment platform
   coolify:

net/compose.yaml

@@ -221,6 +221,8 @@ services:
       - 'traefik.http.routers.${NET_COMPOSE_PROJECT_NAME}-umami-web-secure.middlewares=security-headers@file'
       - 'traefik.http.services.${NET_COMPOSE_PROJECT_NAME}-umami-web-secure.loadbalancer.server.port=3000'
       - 'traefik.docker.network=${NETWORK_NAME}'
+      # Watchtower
+      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
 
   # Mailpit - SMTP server with web UI
   mailpit:

sexy/compose.yaml

@@ -53,6 +53,8 @@ services:
       - 'traefik.http.routers.${SEXY_COMPOSE_PROJECT_NAME}-api-web-secure.middlewares=${SEXY_COMPOSE_PROJECT_NAME}-api-strip,${SEXY_COMPOSE_PROJECT_NAME}-api-web-secure-compress'
       - 'traefik.http.services.${SEXY_COMPOSE_PROJECT_NAME}-api-web-secure.loadbalancer.server.port=8055'
       - 'traefik.docker.network=${NETWORK_NAME}'
+      # Watchtower
+      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
 
   sexy_frontend:
     image: ${SEXY_FRONTEND_IMAGE}

util/compose.yaml

@@ -127,6 +127,9 @@ services:
       MEILI_NO_ANALYTICS: ${UTIL_LINKS_MEILI_NO_ANALYTICS:-true}
     volumes:
       - linkwarden_meili_data:/meili_data
+    labels:
+      # Watchtower
+      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
 
   # Mattermost - Team collaboration
   mattermost: