devops(ci): add --remove-orphans to observability stack deploy steps

Both nightly and release workflows were missing --remove-orphans on the
observability compose up, while the main app deploy step already had it.
Without it, containers removed from docker-compose.observability.yml
linger as unnamed orphans until manually pruned.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/nightly.yml

@@ -136,7 +136,7 @@ jobs:
           docker compose \
             -f docker-compose.observability.yml \
             --env-file .env.staging \
-            up -d --wait
+            up -d --wait --remove-orphans
 
       - name: Reload Caddy
         # Apply any committed Caddyfile changes before smoke-testing the

.gitea/workflows/release.yml

@@ -109,7 +109,7 @@ jobs:
           docker compose \
             -f docker-compose.observability.yml \
             --env-file .env.production \
-            up -d --wait
+            up -d --wait --remove-orphans
 
       - name: Reload Caddy
         # See nightly.yml — same rationale and mechanism: DooD job containers

infra/caddy/Caddyfile

@@ -95,6 +95,6 @@ grafana.archiv.raddatz.cloud {
 }
 
 glitchtip.archiv.raddatz.cloud {
-	header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+	import security_headers
 	reverse_proxy 127.0.0.1:3002
 }