feat: enable Watchtower auto-updates for all application services

Add missing Watchtower labels to:
- net_umami: Analytics service
- dev_gitea_runner: CI/CD runner
- sexy_api: Directus CMS backend
- util_linkwarden_meilisearch: Search engine

All application services now have automatic updates enabled.
Critical infrastructure (postgres, redis, traefik) intentionally
excluded from auto-updates for stability.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

net/compose.yaml

@@ -221,6 +221,8 @@ services:
       - 'traefik.http.routers.${NET_COMPOSE_PROJECT_NAME}-umami-web-secure.middlewares=security-headers@file'
       - 'traefik.http.services.${NET_COMPOSE_PROJECT_NAME}-umami-web-secure.loadbalancer.server.port=3000'
       - 'traefik.docker.network=${NETWORK_NAME}'
+      # Watchtower
+      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
 
   # Mailpit - SMTP server with web UI
   mailpit: