Serve the Zitadel login from the Login V2 container

Zitadel v4 redirects every sign-in to /ui/v2/login, which is served by a
separate container (zitadel-login) that this stack didn't run, so logging
in on a fresh instance ended in a 404.

- Add zitadel-login, with its own service account (login-client) whose
  PAT Zitadel writes to a volume only that container mounts.
- Configure the Login V2 base URL (ZITADEL_LOGIN_BASE_URL): its own port
  in dev, same hostname as Zitadel behind the edge in prod.
- Pin zitadel and zitadel-login to v4.19.1 and add healthchecks.
- Run Zitadel as root, as Zitadel's own compose does, so it can write the
  PATs into root-owned mounts (the Linux bind mount and the new volume).
- Route /ui/v2/login on the auth vhost to the login container and drop
  the no-op grpc_set_header.
- Document the extra steps for an instance created before this.

.env.example

@@ -17,6 +17,11 @@ ZITADEL_MASTERKEY=MasterkeyNeedsToHave32Characters
 ZITADEL_EXTERNAL_DOMAIN=host.docker.internal
 ZITADEL_EXTERNAL_PORT=8080
 ZITADEL_EXTERNAL_SECURE=false
+ZITADEL_PUBLIC_SCHEME=http
+# Login V2 UI (zitadel-login). In dev it has its own port; the URL has no
+# trailing slash. Only read when the Zitadel instance is created.
+ZITADEL_LOGIN_HOST_PORT=3100
+ZITADEL_LOGIN_BASE_URL=http://host.docker.internal:3100/ui/v2/login
 ZITADEL_DATABASE_PASSWORD=zitadel
 # Console login: <username>@zitadel.<external domain>
 ZITADEL_ADMIN_USERNAME=admin