memos: deploy to ana-docker

Stock neosmemo/memos:stable, port 5230, SQLite at
/opt/docker/conf/memos/data/. Joins traefik-net and ships homepage
labels (group=Notes) so it auto-appears on the dashboard via docker
discovery — no edit to configs/homepage/services.yaml needed.

First-run bootstrap is via the UI: visit http://10.250.50.70:5230
and create the Host account through the sign-up form.

Playbook idiom note: docker compose pull lines need the literal
block scalar (|) when the grep pattern contains colons — bare-string
shell value made YAML parse the colon as a mapping separator and
elway choked on first try.

stacks/memos/.env.example

@@ -0,0 +1,22 @@
+# memos stack tunables. Copy to `.env` on ana-docker before deploying.
+
+# Image tag — `stable` tracks upstream's stable channel. Pin a specific
+# version (e.g. `0.24.0`) before any production cutover so a stable
+# bump doesn't surprise you on the next pull.
+MEMOS_TAG=stable
+
+# ── network ──────────────────────────────────────────────────────────
+# Host port (container listens on 5230 internally).
+# Reservations on ana-docker (sample): 5001 Dockge, 7878 task-board,
+# 8080 Miniflux, 8181 news-digest. 5230 is memos' canonical port and
+# was free at deploy time.
+MEMOS_PORT=5230
+MEMOS_BIND=0.0.0.0
+
+# ── runtime ──────────────────────────────────────────────────────────
+MEMOS_TZ=America/Los_Angeles
+
+# ── persistent storage on the host ───────────────────────────────────
+# SQLite DB + uploaded resource files. Backed up via the host's restic
+# profile (memos_prod.db is small; resources/ can grow with attachments).
+MEMOS_DATA_DIR=/opt/docker/conf/memos/data