CI owns the whole stack — deploy via docker stack deploy

- stack.yml: parameterize image tag with ${IMAGE_TAG:-latest} so callers
  can pin the SHA; falls back to :latest for manual invocations
- flow.yml: replace service update with `docker stack deploy -c -`
  piped over SSH. Handles both first-time deploy and rolling updates.
  No more manual `docker stack deploy` on the manager before CI works.

Portainer can still view the stack but should not auto-update the same
one from git — two writers will conflict.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

stack.yml

@@ -10,7 +10,7 @@ networks:
 
 services:
   web:
-    image: git.dev.serso.org/test/testsite:latest
+    image: git.dev.serso.org/test/testsite:${IMAGE_TAG:-latest}
     networks:
       - traefik-public
     deploy: