comfyui: add stack + deploy to irv-ml1

New stack mirroring PFI convention (stacks/comfyui/) using
mmartial/comfyui-nvidia-docker:ubuntu24_cuda12.8-20260312. Both GPUs
exposed, pinned to CUDA 12.8 to match the host's 570.x driver and the
native cuda-toolkit already in place.

Layout — single tree under /worktank/comfyui/ (462G dedicated, 1%
used pre-deploy):
  - basedir/  → /basedir   user state (models, workflows, custom_nodes,
                           input, output); owned 1000:1000 so external
                           tools can edit workflow JSON directly.
  - run/      → /comfy/mnt  ComfyUI source + venv + pip cache (~7.8G
                           after bootstrap). Bind mount instead of
                           named volume — the image refuses to chown
                           mounted paths at startup, so keeping this
                           lkraven-owned avoids the sudo dance.

servers/irv-ml1/README.md refreshed: Docker upgraded to 29.4.1 with
traefik-net in place; dockge + beszel-agent + dozzle-agent already
present; /storetank dropped 92% → 64%; restic coverage to
rest-server-nh3 is operational (not "currently none" as prior text).

stacks/comfyui/compose.yaml

@@ -0,0 +1,63 @@
+# ComfyUI — node-based Stable Diffusion / Flux inference UI.
+#
+# Runs on irv-ml1 (dual GPU: RTX 3090 + RTX A6000). Both GPUs are
+# exposed via NVIDIA_VISIBLE_DEVICES=all so GPU selection happens
+# per-workflow inside ComfyUI.
+#
+# All user state — models, workflows, custom_nodes, input, output —
+# lives under a single BASE_DIRECTORY tree on /worktank (462 GB
+# dedicated), owned by lkraven:lkraven (1000:1000) so external
+# tooling can read and write workflow files directly on the host.
+#
+# Runtime state (ComfyUI source, venv, pip cache) lives in a bind
+# mount at ${COMFYUI_RUNDIR} — disposable (can be wiped on version
+# bumps to force re-bootstrap), but owned by the host user so no
+# sudo dance is needed. (Named volumes would be created root-owned
+# and the image refuses to chown a mounted path.)
+#
+# First-run prerequisite: both ${COMFYUI_BASEDIR} and ${COMFYUI_RUNDIR}
+# must exist on the host with ownership matching COMFYUI_UID:COMFYUI_GID
+# before `up`. See README for the bootstrap command.
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  comfyui:
+    image: mmartial/comfyui-nvidia-docker:${COMFYUI_VERSION}
+    container_name: comfyui
+    restart: unless-stopped
+    runtime: nvidia
+    ports:
+      - "${COMFYUI_BIND:-0.0.0.0}:${COMFYUI_PORT}:8188"
+    environment:
+      - NVIDIA_VISIBLE_DEVICES=all
+      - WANTED_UID=${COMFYUI_UID}
+      - WANTED_GID=${COMFYUI_GID}
+      - BASE_DIRECTORY=/basedir
+      - SECURITY_LEVEL=${COMFYUI_SECURITY_LEVEL:-normal}
+      - USE_UV=true
+    volumes:
+      - ${COMFYUI_BASEDIR}:/basedir
+      - ${COMFYUI_RUNDIR}:/comfy/mnt
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost:8188/ >/dev/null || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      # First boot installs ~5 GB of Python packages; allow generous
+      # start_period so the container isn't marked unhealthy during
+      # bootstrap. Subsequent starts are fast.
+      start_period: 600s
+    networks:
+      - tnet
+    labels:
+      - homepage.group=AI Systems
+      - homepage.name=ComfyUI
+      - homepage.icon=mdi-image-auto-adjust
+      - homepage.description=Node-based SD/Flux inference (irv-ml1)
+      - homepage.href=http://10.100.79.3:${COMFYUI_PORT}
+
+networks:
+  tnet:
+    name: traefik-net
+    external: true