Serve the Zitadel login from the Login V2 container

Zitadel v4 redirects every sign-in to /ui/v2/login, which is served by a
separate container (zitadel-login) that this stack didn't run, so logging
in on a fresh instance ended in a 404.

- Add zitadel-login, with its own service account (login-client) whose
  PAT Zitadel writes to a volume only that container mounts.
- Configure the Login V2 base URL (ZITADEL_LOGIN_BASE_URL): its own port
  in dev, same hostname as Zitadel behind the edge in prod.
- Pin zitadel and zitadel-login to v4.19.1 and add healthchecks.
- Run Zitadel as root, as Zitadel's own compose does, so it can write the
  PATs into root-owned mounts (the Linux bind mount and the new volume).
- Route /ui/v2/login on the auth vhost to the login container and drop
  the no-op grpc_set_header.
- Document the extra steps for an instance created before this.

edge/conf.d/musify.conf

@@ -80,11 +80,17 @@ server {
     ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
     include /etc/nginx/snippets/tls.conf;
 
+    # Login V2 UI, a separate container (see ../compose.yml).
+    location /ui/v2/login {
+        set $upstream http://infra-zitadel-login:3000;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+    }
+
     location / {
         set $upstream http://zitadel:8080;
         proxy_pass $upstream;
         include /etc/nginx/snippets/proxy.conf;
-        grpc_set_header Host $host;
     }
 }