fix(podman): use Type=notify + service-container so systemd sees pod crashes

The previous Type=oneshot + RemainAfterExit=true pattern made systemd
freeze pod units in 'active (exited)' as soon as 'podman play kube'
returned, so crash-looping containers were invisible to
'systemctl --user --failed' and Restart=on-failure never fired.

For every podman-pod role (immich, fdroid, ntfy, gitea, qfieldcloud,
unifi, matrix, uptime_kuma):

- switch units to Type=notify + NotifyAccess=all
- run 'podman kube play --service-container=true' so the unit's main
  PID stays alive as long as the pod
- use 'podman kube down' for ExecStop
- add TimeoutStartSec=180 to cover slow first-boot image pulls

Pod manifests: flip every container's restartPolicy from Always to
Never. systemd is now the single owner of the restart loop: container
exits -> pod dies -> service container dies -> unit fails ->
Restart=on-failure restarts everything cleanly. With Always, podman
retried internally and hid the failure from systemd.

CLAUDE.md updated to document the new canonical template and the
'restartPolicy: Never' requirement.

roles/uptime_kuma/templates/uptime-kuma.service.j2

@@ -2,13 +2,14 @@
 Description=Uptime Kuma Monitoring Service
 
 [Service]
-Type=oneshot
-RemainAfterExit=true
+Type=notify
+NotifyAccess=all
 WorkingDirectory={{ podman_projects_dir | default('/opt/podman') }}/uptime-kuma
-ExecStart=/usr/bin/podman play kube --replace uptime-kuma.yaml
-ExecStop=/usr/bin/podman play kube --down uptime-kuma.yaml
+ExecStart=/usr/bin/podman kube play --replace --service-container=true uptime-kuma.yaml
+ExecStop=/usr/bin/podman kube down uptime-kuma.yaml
 Restart=on-failure
 RestartSec=10
+TimeoutStartSec=180
 
 [Install]
 WantedBy=default.target

roles/uptime_kuma/templates/uptime-kuma.yaml.j2

@@ -21,7 +21,7 @@ spec:
           readOnly: true
         - name: uptime-kuma-data
           mountPath: /app/data
-      restartPolicy: Always
+      restartPolicy: Never
 
   volumes:
     - name: localtime