Add custom CI runner images: self-hosted registry, ssh-alpine image, biweekly rebuild

- Enabled GitLab Container Registry on its own subdomain via NPM/mkcert
- Built minimal ssh-alpine image (Alpine + OpenSSH, key-only auth)
- Docker-outside-of-Docker build pipeline reusing the host socket, no DinD
- Forced --pull --no-cache builds so scheduled rebuilds pick up real upstream updates
- Biweekly Pipeline Schedule (cron: 0 3 */14 * *)
- Registry cleanup policy to prevent unbounded tag growth
- Documented the Tailscale/Pi-hole DNS conflict and other gotchas hit along the way

docker-compose/gitlab/ci-images-reference/README.md

@@ -0,0 +1,5 @@
+# ci-images (reference copy)
+
+This folder mirrors the `.gitlab-ci.yml` and `Dockerfile`(s) from the `ci-images` project, which lives in the self-hosted GitLab instance (not GitHub) — kept here so the work is visible in this repo too. See [docs/CI-Custom-Images.md](../../../docs/CI-Custom-Images.md) for the full write-up.
+
+The live project has its own git history, pipeline runs, and pushes to the self-hosted Container Registry at `registry.gitlab.home` — this folder is documentation, not a working deployment target.