ci: run client builds on a Java 25 build agent instead of the controller

The toolchain image becomes a Jenkins inbound agent (jenkins/inbound-agent,
Java 25) labelled dorknet-builder. Jenkins itself stays on the stock image
and runs no builds, which also clears the built-in-node warning.

- Dockerfile: inbound-agent base; restic cache on the agent's own volume
- docker-compose.yml: the agent as a Coolify Docker Compose application,
  reaching Jenkins over WebSocket on the predefined Coolify network
- Jenkinsfile: agent { label 'dorknet-builder' }
- README: Java 25 for both sides (Java 21 support ends Sep 2027, Java 17
  is unsupported), restart policy, node setup and Coolify deployment

ci/jenkins/docker-compose.yml

@@ -1,31 +1,31 @@
-# Reference for the Jenkins service on Dokploy, built from this directory's
-# Dockerfile (the stock Jenkins image plus the client build toolchain).
-#
-# Use it on your EXISTING Jenkins service rather than as a second Jenkins.
-# The data volume must be the one Jenkins uses today, or Jenkins starts empty.
-# Point `volumes:` at that volume (and its name under the top-level
-# `volumes:`, marked `external: true`), or keep this service's name and volume
-# if they already match. See ci/jenkins/README.md.
+# DorkNet build agent on Coolify. Deploy as a Docker Compose application from
+# this repository with compose location /ci/jenkins/docker-compose.yml and
+# "Connect to predefined network" on. It needs no domain: it dials out to
+# Jenkins over WebSocket on Docker's internal network. Set the variables in
+# the resource's Environment Variables; see ci/jenkins/README.md.
 services:
-  jenkins:
+  agent:
     build:
       context: .
       dockerfile: Dockerfile
-      args:
-        # The image your Jenkins runs today, so the Jenkins version and Java
-        # stay the same.
-        JENKINS_IMAGE: ${JENKINS_IMAGE:-jenkins/jenkins:lts-jdk17}
     restart: unless-stopped
-    expose:
-      - "8080"
     environment:
+      # Jenkins as seen from inside Docker (e.g. http://<jenkins container
+      # name>:8080), not the public URL, which is behind Cloudflare Access.
+      JENKINS_URL: ${JENKINS_URL:?set JENKINS_URL to Jenkins' internal address}
+      JENKINS_AGENT_NAME: ${JENKINS_AGENT_NAME:-dorknet-builder}
+      JENKINS_SECRET: ${JENKINS_SECRET:?set JENKINS_SECRET to the node secret}
+      JENKINS_WEB_SOCKET: "true"
+      JENKINS_AGENT_WORKDIR: /home/jenkins/agent
       # Where the stock builds live in the archive (restic repository folders
-      # on the FTP), as plain text. Overridable per run.
+      # on the FTP, plain text). Overridable per run.
       ARCHIVE_PC_REPO: ${ARCHIVE_PC_REPO:-}
       ARCHIVE_QUEST_REPO: ${ARCHIVE_QUEST_REPO:-}
       ARCHIVE_FTP_TLS: ${ARCHIVE_FTP_TLS:-explicit}
     volumes:
-      - jenkins_home:/var/jenkins_home
+      - dorknet_cache:/home/jenkins/dorknet-cache
+      - agent_work:/home/jenkins/agent
 
 volumes:
-  jenkins_home:
+  dorknet_cache:
+  agent_work: