feat(_update): replace watchtower with custom nightly update script

Removes the watchtower container in favour of a host-side script that
runs daily at 2:00 AM via systemd timer.  Mirrors the _backup pattern:
auto-discovers stacks, pulls images, recreates changed containers,
prunes dangling images, and notifies via n8n → Telegram.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

immich/compose.yml

@@ -33,7 +33,6 @@ services:
       - "traefik.http.routers.immich-web-secure.middlewares=security-headers@file,no-index@file"
       - "traefik.http.services.immich-web-secure.loadbalancer.server.port=2283"
       - "traefik.docker.network=${NETWORK_NAME}"
-      - "com.centurylinklabs.watchtower.enable=true"
     networks:
       - compose_network
   ml:
@@ -45,7 +44,6 @@ services:
       - ../.data/immich/model-cache:/cache
     restart: always
     labels:
-      - "com.centurylinklabs.watchtower.enable=true"
     networks:
       - compose_network
   redis: