fix: disable Watchtower auto-updates for paint service

Paint service uses a custom Dockerfile build from GitHub, so it shouldn't
be auto-updated by Watchtower. Set watchtower.enable=false explicitly.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

kit/compose.yaml

@@ -78,8 +78,8 @@ services:
       # Service
       - 'traefik.http.services.${KIT_COMPOSE_PROJECT_NAME}-paint.loadbalancer.server.port=80'
       - 'traefik.docker.network=${NETWORK_NAME}'
-      # Watchtower
-      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
+      # Watchtower - disabled for paint (custom build)
+      - 'com.centurylinklabs.watchtower.enable=false'
 
   pastel_api:
     image: ${KIT_PASTEL_API_IMAGE:-ghcr.io/valknarness/pastel-api:latest}