feat: add Pastel color palette generator to Kit stack

Added Pastel service with API and UI to the Kit toolkit:

**New Services:**
- pastel_api: Backend API for color palette generation
  - Image: ghcr.io/valknarness/pastel-api:latest
  - Routes: https://pastel.kit.pivoine.art/api

- pastel_ui: Frontend UI for interactive palette generation
  - Image: ghcr.io/valknarness/pastel-ui:latest
  - Routes: https://pastel.kit.pivoine.art

**Features:**
- Color harmony algorithms
- Interactive palette generation
- Export in various formats
- Programmatic API access
- Path-based routing (UI on root, API on /api)

**Configuration:**
- Updated arty.yml with KIT_PASTEL_* variables
- Updated documentation (CLAUDE.md, README.md)
- Added Traefik labels with SSL, compression, security headers
- Watchtower auto-update enabled

Kit stack now includes 5 services:
- Landing page (kit.pivoine.art)
- Vert file converter (vert.kit.pivoine.art)
- Paint image editor (paint.kit.pivoine.art)
- Pastel color generator (pastel.kit.pivoine.art)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

kit/compose.yaml

@@ -69,7 +69,7 @@ services:
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-paint-web.middlewares=${KIT_COMPOSE_PROJECT_NAME}-paint-redirect-web-secure'
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-paint-web.rule=Host(`${KIT_PAINT_TRAEFIK_HOST}`)'
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-paint-web.entrypoints=web'
-      # HTTPS router with auth
+      # HTTPS router
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-paint-web-secure.rule=Host(`${KIT_PAINT_TRAEFIK_HOST}`)'
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-paint-web-secure.tls.certresolver=resolver'
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-paint-web-secure.entrypoints=web-secure'
@@ -81,6 +81,58 @@ services:
       # Watchtower
       - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
 
+  pastel_api:
+    image: ${KIT_PASTEL_API_IMAGE:-ghcr.io/valknarness/pastel-api:latest}
+    container_name: ${KIT_COMPOSE_PROJECT_NAME}_pastel_api
+    restart: unless-stopped
+    networks:
+      - compose_network
+    labels:
+      - 'traefik.enable=${KIT_TRAEFIK_ENABLED}'
+      # HTTP to HTTPS redirect
+      - 'traefik.http.middlewares.${KIT_COMPOSE_PROJECT_NAME}-pastel-api-redirect-web-secure.redirectscheme.scheme=https'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-api-web.middlewares=${KIT_COMPOSE_PROJECT_NAME}-pastel-api-redirect-web-secure'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-api-web.rule=Host(`${KIT_PASTEL_TRAEFIK_HOST}`) && PathPrefix(`/api`)'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-api-web.entrypoints=web'
+      # HTTPS router
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-api-web-secure.rule=Host(`${KIT_PASTEL_TRAEFIK_HOST}`) && PathPrefix(`/api`)'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-api-web-secure.tls.certresolver=resolver'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-api-web-secure.entrypoints=web-secure'
+      - 'traefik.http.middlewares.${KIT_COMPOSE_PROJECT_NAME}-pastel-api-compress.compress=true'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-api-web-secure.middlewares=${KIT_COMPOSE_PROJECT_NAME}-pastel-api-compress,security-headers@file'
+      # Service
+      - 'traefik.http.services.${KIT_COMPOSE_PROJECT_NAME}-pastel-api.loadbalancer.server.port=80'
+      - 'traefik.docker.network=${NETWORK_NAME}'
+      # Watchtower
+      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
+
+  pastel_ui:
+    image: ${KIT_PASTEL_UI_IMAGE:-ghcr.io/valknarness/pastel-ui:latest}
+    container_name: ${KIT_COMPOSE_PROJECT_NAME}_pastel_ui
+    restart: unless-stopped
+    networks:
+      - compose_network
+    labels:
+      - 'traefik.enable=${KIT_TRAEFIK_ENABLED}'
+      # HTTP to HTTPS redirect
+      - 'traefik.http.middlewares.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-redirect-web-secure.redirectscheme.scheme=https'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web.middlewares=${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-redirect-web-secure'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web.rule=Host(`${KIT_PASTEL_TRAEFIK_HOST}`)'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web.entrypoints=web'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web.priority=1'
+      # HTTPS router
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web-secure.rule=Host(`${KIT_PASTEL_TRAEFIK_HOST}`)'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web-secure.tls.certresolver=resolver'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web-secure.entrypoints=web-secure'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web-secure.priority=1'
+      - 'traefik.http.middlewares.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-compress.compress=true'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web-secure.middlewares=${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-compress,security-headers@file'
+      # Service
+      - 'traefik.http.services.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui.loadbalancer.server.port=80'
+      - 'traefik.docker.network=${NETWORK_NAME}'
+      # Watchtower
+      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
+
 networks:
   compose_network:
     name: ${NETWORK_NAME}