feat(_update): replace watchtower with custom nightly update script

Removes the watchtower container in favour of a host-side script that
runs daily at 2:00 AM via systemd timer.  Mirrors the _backup pattern:
auto-discovers stacks, pulls images, recreates changed containers,
prunes dangling images, and notifies via n8n → Telegram.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

umami/compose.yml

@@ -28,7 +28,6 @@ services:
       - "traefik.http.routers.umami-web-secure.middlewares=security-headers@file,no-index@file"
       - "traefik.http.services.umami-web-secure.loadbalancer.server.port=3000"
       - "traefik.docker.network=${NETWORK_NAME}"
-      - "com.centurylinklabs.watchtower.enable=true"
     networks:
       - compose_network
   db: