feat: add pulsenode stack

Infrastructure dashboard monitoring all the stacks in this repo, built
via stacks new pulsenode and then hand-adjusted for what a generic
scaffold can't know: pulls the published image
(dev.pivoine.art/valknar/pulsenode:latest) instead of building, mounts
/var/run/docker.sock:ro plus its own config/ directory read-only, runs
read-only/non-root/cap-dropped (group_add on DOCKER_GID to get socket
access without running as root), and uses its own healthcheck.mjs
rather than curl (not present in its minimal image).

config/config.yml is real, not a placeholder: docker/database widgets
for every container across all ten stacks here, discovery enabled
against falcon_network as a safety net for anything added later.

pulsenode/compose.yml

@@ -0,0 +1,47 @@
+services:
+  pulsenode:
+    image: dev.pivoine.art/valknar/pulsenode:latest
+    container_name: pulsenode
+    read_only: true
+    tmpfs:
+      - /tmp
+      - /app/.next/cache
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    # Non-root container, but /var/run/docker.sock is owned by root:docker on
+    # the host - without joining that GID it gets EACCES. DOCKER_GID is this
+    # host's docker group id (getent group docker | cut -d: -f3).
+    group_add:
+      - "${DOCKER_GID}"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./config:/app/config:ro
+    env_file: .env
+    restart: always
+    healthcheck:
+      test: ["CMD", "node", "healthcheck.mjs"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.pulsenode-web.rule=Host(`${TRAEFIK_HOST}`)"
+      - "traefik.http.routers.pulsenode-web.entrypoints=web"
+      - "traefik.http.routers.pulsenode-web.middlewares=pulsenode-redirect-web-secure"
+      - "traefik.http.middlewares.pulsenode-redirect-web-secure.redirectscheme.scheme=https"
+      - "traefik.http.routers.pulsenode-web-secure.rule=Host(`${TRAEFIK_HOST}`)"
+      - "traefik.http.routers.pulsenode-web-secure.entrypoints=web-secure"
+      - "traefik.http.routers.pulsenode-web-secure.tls.certresolver=resolver"
+      - "traefik.http.routers.pulsenode-web-secure.middlewares=security-headers@file,no-index@file"
+      - "traefik.http.services.pulsenode-web-secure.loadbalancer.server.port=3000"
+      - "traefik.docker.network=${NETWORK_NAME}"
+    networks:
+      - compose_network
+
+networks:
+  compose_network:
+    name: ${NETWORK_NAME}
+    external: true