feat: add Kit landing page at kit.pivoine.art

Added kit-ui landing page as the main entry point for the toolkit:
- Image: ghcr.io/valknarness/kit-ui:latest
- URL: https://kit.pivoine.art
- Provides links to Vert (file converter) and Paint (image editor)

Changes:
- Added landing service to kit/compose.yaml
- Updated arty.yml with KIT_TRAEFIK_HOST and KIT_LANDING_IMAGE
- Updated CLAUDE.md with landing page documentation
- Updated README.md with landing page reference

Toolkit structure:
- Landing: kit.pivoine.art (main hub)
- Vert: vert.kit.pivoine.art (file converter)
- Paint: paint.kit.pivoine.art (image editor)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

kit/compose.yaml

@@ -1,4 +1,29 @@
 services:
+  landing:
+    image: ${KIT_LANDING_IMAGE:-ghcr.io/valknarness/kit-ui:latest}
+    container_name: ${KIT_COMPOSE_PROJECT_NAME}_landing
+    restart: unless-stopped
+    networks:
+      - compose_network
+    labels:
+      - 'traefik.enable=${KIT_TRAEFIK_ENABLED}'
+      # HTTP to HTTPS redirect
+      - 'traefik.http.middlewares.${KIT_COMPOSE_PROJECT_NAME}-landing-redirect-web-secure.redirectscheme.scheme=https'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-landing-web.middlewares=${KIT_COMPOSE_PROJECT_NAME}-landing-redirect-web-secure'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-landing-web.rule=Host(`${KIT_TRAEFIK_HOST}`)'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-landing-web.entrypoints=web'
+      # HTTPS router
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-landing-web-secure.rule=Host(`${KIT_TRAEFIK_HOST}`)'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-landing-web-secure.tls.certresolver=resolver'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-landing-web-secure.entrypoints=web-secure'
+      - 'traefik.http.middlewares.${KIT_COMPOSE_PROJECT_NAME}-landing-compress.compress=true'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-landing-web-secure.middlewares=${KIT_COMPOSE_PROJECT_NAME}-landing-compress,security-headers@file'
+      # Service
+      - 'traefik.http.services.${KIT_COMPOSE_PROJECT_NAME}-landing.loadbalancer.server.port=80'
+      - 'traefik.docker.network=${NETWORK_NAME}'
+      # Watchtower
+      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
+
   vert:
     image: ${KIT_VERT_IMAGE:-ghcr.io/vert-sh/vert:latest}
     container_name: ${KIT_COMPOSE_PROJECT_NAME}_vert