feat(demo): migrate 5 SelfStack services to demo stack (16→24 services)

Add Reactive Resume, Metrics, Kiwix, Resume Matcher, and Apple Health
from the earlier SelfStack project. Rewrite Apple Health collector to
use InfluxDB v2 with proper error handling. Update all tests, scripts,
Homepage config, env template, and documentation for the expanded stack.

New services:
- Reactive Resume (4016) + Postgres/Minio/Chrome companions
- Metrics (4021) - GitHub metrics visualization
- Kiwix (4022) - offline wiki reader
- Resume Matcher (4023) - AI resume screening
- Apple Health (4024) - health data collector → InfluxDB v2

Also adds git policy to AGENTS.md: always commit and push automatically.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

demo/tests/unit/test_env_validation.sh

@@ -47,12 +47,13 @@ test_template_has_required_sections() {
 }
 
 test_template_has_all_services() {
-    check "Template defines all 16 services"
+    check "Template defines all 24 services"
     local services=(
         "docker-socket-proxy:" "homepage:" "pihole:" "dockhand:"
         "influxdb:" "grafana:" "drawio:" "kroki:" "atomictracker:"
         "archivebox:" "ta-redis:" "ta-elasticsearch:" "tubearchivist:"
         "wakapi:" "mailhog:" "atuin:"
+        "reactiveresume-postgres:" "reactiveresume-minio:" "reactiveresume-chrome:" "reactiveresume-app:" "metrics:" "kiwix:" "resumematcher:" "applehealth:"
     )
     local found=0
     for svc in "${services[@]}"; do
@@ -69,7 +70,7 @@ test_template_has_all_services() {
 
 test_all_services_have_healthchecks() {
     check "All exposed services have healthcheck blocks"
-    local exposed_services=("homepage" "pihole" "dockhand" "influxdb" "grafana" "drawio" "kroki" "atomictracker" "archivebox" "tubearchivist" "wakapi" "mailhog" "atuin")
+    local exposed_services=("homepage" "pihole" "dockhand" "influxdb" "grafana" "drawio" "kroki" "atomictracker" "archivebox" "tubearchivist" "wakapi" "mailhog" "atuin" "reactiveresume-app" "metrics" "kiwix" "resumematcher" "applehealth")
     local missing=()
     for svc in "${exposed_services[@]}"; do
         local svc_block
@@ -91,16 +92,16 @@ test_all_services_have_restart_policy() {
     check "All services have restart policy"
     local restart_count
     restart_count=$(grep -c "restart:" "$TEMPLATE_FILE" || true)
-    if [[ $restart_count -ge 16 ]]; then
+    if [[ $restart_count -ge 24 ]]; then
         pass "$restart_count services have restart policies"
     else
-        fail "Only $restart_count services have restart policies (expected >= 16)"
+        fail "Only $restart_count services have restart policies (expected >= 24)"
     fi
 }
 
 test_all_services_have_labels() {
     check "All user-facing services have Homepage labels"
-    local label_services=("homepage" "pihole" "dockhand" "influxdb" "grafana" "drawio" "kroki" "atomictracker" "archivebox" "tubearchivist" "wakapi" "mailhog" "atuin")
+    local label_services=("homepage" "pihole" "dockhand" "influxdb" "grafana" "drawio" "kroki" "atomictracker" "archivebox" "tubearchivist" "wakapi" "mailhog" "atuin" "reactiveresume-app" "metrics" "kiwix" "resumematcher" "applehealth")
     local missing=()
     for svc in "${label_services[@]}"; do
         local svc_block
@@ -163,6 +164,7 @@ test_env_template_completeness() {
         "TA_USERNAME" "TA_PASSWORD" "ELASTIC_PASSWORD"
         "GF_SECURITY_ADMIN_USER" "GF_SECURITY_ADMIN_PASSWORD"
         "PIHOLE_WEBPASSWORD"
+        "REACTIVE_RESUME_PORT" "RESUME_MINIO_PORT" "METRICS_PORT" "KIWIX_PORT" "RESUME_MATCHER_PORT" "APPLEHEALTH_PORT" "RESUME_POSTGRES_PASSWORD"
     )
     for var in "${required_vars[@]}"; do
         if grep_exists "^${var}=" "$ENV_TEMPLATE"; then