fix: use versioned image tag via var.image_tag, align Traefik tags with DevOpsMCP pattern

- Add service_name and image_tag variables to nomad job
- Use ${var.image_tag} in image ref instead of hardcoded 'latest'
- CI now passes git SHA as -var='image_tag=<sha>' to nomad job run
- Align Traefik tags with DevOpsMCP pattern (service_name var, rate limiting)
- Add canary update strategy and reschedule block
- Move service block to group level (nomad best practice)

.gitea/workflows/ci.yml

@@ -47,8 +47,9 @@ jobs:
 
       - name: Deploy to Nomad
         run: |
+          SHA=$(git rev-parse --short HEAD)
           nomad job validate ${SERVICE_NAME}.nomad
-          nomad job run ${SERVICE_NAME}.nomad
+          nomad job run -var="image_tag=${SHA}" ${SERVICE_NAME}.nomad
         env:
           NOMAD_ADDR: "https://nomad.i80.dk:4646"