ci: keep docker-compose.yml as the controller; move the agent to its own file

Turning ci/jenkins/docker-compose.yml from the controller into the agent meant
that redeploying a Jenkins set up from the old file would replace the
controller with an agent. Keep that file as the controller instead: the same
jenkins service and jenkins_home volume, now on the stock Java 25 image (its
old build context, ci/jenkins/Dockerfile, is the agent image now). The agent
moves to docker-compose.agent.yml. This replaces the previous commit's warning.

ci/jenkins/docker-compose.yml

@@ -1,39 +1,25 @@
-# DorkNet build agent on Coolify. Deploy as a Docker Compose application from
-# this repository with base directory /ci/jenkins, compose location
-# /docker-compose.yml and "Connect to predefined network" on. It needs no domain: it dials out to
-# Jenkins over WebSocket on Docker's internal network. Set the variables in
-# the resource's Environment Variables; see ci/jenkins/README.md.
+# The Jenkins controller: stock Jenkins on Java 25. It runs no builds; the
+# client builds run on the agent (docker-compose.agent.yml). On Coolify,
+# deploy it as a Docker Compose application from this repository (base
+# directory /ci/jenkins) or paste it into a Compose service, with "Connect to
+# predefined network" on so the agent can reach it. See ci/jenkins/README.md.
 #
-# This file used to define the Jenkins controller itself. If your Jenkins was
-# deployed from it, don't redeploy that application from this version: it
-# would replace the controller with an agent. Move the controller to its own
-# service first and deploy this as a NEW application (README: "Upgrading from
-# the old setup").
+# Earlier versions of this file built the controller from ci/jenkins/Dockerfile,
+# which is now the agent's image. The service name and data volume are the
+# same, so redeploying an existing Jenkins from this file keeps its jobs and
+# credentials; its builds then wait for the agent.
 services:
-  agent:
-    build:
-      context: .
-      dockerfile: Dockerfile
+  jenkins:
+    # Pin a version with e.g. jenkins/jenkins:2.587-jdk25. Keep the agent on
+    # the same Java major version (its image defaults to Java 25).
+    image: ${JENKINS_IMAGE:-jenkins/jenkins:lts-jdk25}
+    # A restart from the Jenkins UI exits with code 5 and relies on Docker to
+    # start it again.
     restart: unless-stopped
-    environment:
-      # Jenkins as seen from inside Docker (e.g. http://<jenkins container
-      # name>:8080), not the public URL, which is behind Cloudflare Access.
-      # Both are needed at runtime only; keep them out of the image build so
-      # the node secret never reaches a build argument.
-      JENKINS_URL: ${JENKINS_URL}
-      JENKINS_AGENT_NAME: ${JENKINS_AGENT_NAME:-dorknet-builder}
-      JENKINS_SECRET: ${JENKINS_SECRET}
-      JENKINS_WEB_SOCKET: "true"
-      JENKINS_AGENT_WORKDIR: /home/jenkins/agent
-      # Where the stock builds live in the archive (restic repository folders
-      # on the FTP, plain text). Overridable per run.
-      ARCHIVE_PC_REPO: ${ARCHIVE_PC_REPO:-}
-      ARCHIVE_QUEST_REPO: ${ARCHIVE_QUEST_REPO:-}
-      ARCHIVE_FTP_TLS: ${ARCHIVE_FTP_TLS:-explicit}
+    expose:
+      - "8080"
     volumes:
-      - dorknet_cache:/home/jenkins/dorknet-cache
-      - agent_work:/home/jenkins/agent
+      - jenkins_home:/var/jenkins_home
 
 volumes:
-  dorknet_cache:
-  agent_work:
+  jenkins_home: