feat: add Joplin Server stack for note-taking and synchronization

Added Joplin Server deployment at joplin.pivoine.art:

**Joplin stack** (joplin.pivoine.art):
- joplin: Note-taking server with multi-device sync
  - PostgreSQL backend for data persistence
  - End-to-end encryption support
  - Compatible with official Joplin clients (desktop, mobile, CLI)
  - Markdown-based notes with attachments

Infrastructure updates:
- Added joplin database to PostgreSQL init script
- Updated compose.yaml to include joplin stack
- Added JOPLIN_* environment variables to arty.yml
- Added joplin-backup plan to restic (13th backup plan)
- Updated restic/compose.yaml with joplin_data volume mount
- Updated README.md and CLAUDE.md documentation

All services integrated with Traefik for SSL termination and include
Watchtower auto-update labels. Daily backups scheduled for 2 AM with
7 daily, 4 weekly, 6 monthly, and 2 yearly retention.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

joplin/compose.yaml

@@ -0,0 +1,38 @@
+services:
+  joplin:
+    image: ${JOPLIN_IMAGE:-joplin/server:latest}
+    container_name: ${JOPLIN_COMPOSE_PROJECT_NAME}_app
+    restart: unless-stopped
+    environment:
+      TZ: ${TIMEZONE:-Europe/Berlin}
+      APP_PORT: ${JOPLIN_APP_PORT:-22300}
+      APP_BASE_URL: https://${JOPLIN_TRAEFIK_HOST}
+      DB_CLIENT: pg
+      POSTGRES_HOST: ${CORE_DB_HOST}
+      POSTGRES_PORT: ${CORE_DB_PORT}
+      POSTGRES_DATABASE: ${JOPLIN_DB_NAME}
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+    networks:
+      - compose_network
+    depends_on:
+      - postgres
+    labels:
+      - 'traefik.enable=${JOPLIN_TRAEFIK_ENABLED}'
+      - 'traefik.http.middlewares.${JOPLIN_COMPOSE_PROJECT_NAME}-redirect-web-secure.redirectscheme.scheme=https'
+      - 'traefik.http.routers.${JOPLIN_COMPOSE_PROJECT_NAME}-web.middlewares=${JOPLIN_COMPOSE_PROJECT_NAME}-redirect-web-secure'
+      - 'traefik.http.routers.${JOPLIN_COMPOSE_PROJECT_NAME}-web.rule=Host(`${JOPLIN_TRAEFIK_HOST}`)'
+      - 'traefik.http.routers.${JOPLIN_COMPOSE_PROJECT_NAME}-web.entrypoints=web'
+      - 'traefik.http.routers.${JOPLIN_COMPOSE_PROJECT_NAME}-web-secure.rule=Host(`${JOPLIN_TRAEFIK_HOST}`)'
+      - 'traefik.http.routers.${JOPLIN_COMPOSE_PROJECT_NAME}-web-secure.tls.certresolver=resolver'
+      - 'traefik.http.routers.${JOPLIN_COMPOSE_PROJECT_NAME}-web-secure.entrypoints=web-secure'
+      - 'traefik.http.middlewares.${JOPLIN_COMPOSE_PROJECT_NAME}-web-secure-compress.compress=true'
+      - 'traefik.http.routers.${JOPLIN_COMPOSE_PROJECT_NAME}-web-secure.middlewares=${JOPLIN_COMPOSE_PROJECT_NAME}-web-secure-compress'
+      - 'traefik.http.services.${JOPLIN_COMPOSE_PROJECT_NAME}-web-secure.loadbalancer.server.port=22300'
+      - 'traefik.docker.network=${NETWORK_NAME}'
+      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
+
+networks:
+  compose_network:
+    name: ${NETWORK_NAME}
+    external: true