kick docker stacks up after boot

Created by: jedmund

Summary

• Adds docker-stacks-up.service — oneshot that runs docker compose up -d across every /opt/docker/*/compose.yaml ~10s after docker.service is up
• Adds roles/docker/NOTES.md documenting the NFS boot race, this mitigation, and the host-level-NFS alternative we considered but didn't take

Context

PR #8 installed nas-reachable.service + a docker drop-in to wait for NAS TCP reachability before starting docker. Testing showed this wasn't enough: docker waits correctly, but the NFS mount race happens within docker's own container-restore sweep (bridge/nftables setup briefly disrupts routing), and TCP reachability 1s earlier doesn't prevent mount failures 1s later. 18/75 containers still exited 128 on the test reboot.

This kick service is the belt-and-suspenders step — any container docker's own restore missed gets started by the subsequent docker compose up -d. NOTES.md explains why we chose this over migrating to host-level NFS mounts (host-wide blast radius of a NAS outage is the main reason).

Test plan

• applied manually to nuc-mini; service enabled, status inactive (dead) until next boot
• reboot nuc-mini, confirm all containers come back — either docker's restore gets them, or docker-stacks-up kicks in ~10s later
• run the playbook against nuc-mini to confirm idempotence