Add help-osk-docs stack: Zensical instructions site for 05-osk

Static instructions site for client 05 served at help.osk.team. Markdown +
images built by Zensical (zensical build) into public/, served by nginx behind
Traefik. Content is bind-mounted from /mnt/containers/help-osk-docs (absolute
host path — Portainer GitOps can't resolve relative mounts). Adds the
help/help-osk router+service to traefik/dynamic/web.yml (TLS via Let's Encrypt,
public/open).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

help-osk-docs/docker-compose.yaml

@@ -0,0 +1,37 @@
+services:
+  # One-shot builder. Zensical's official image is for builds/previews only
+  # (NOT a host server), so we use it to render docs/ -> public/, then exit.
+  help-osk-build:
+    image: zensical/zensical:latest
+    container_name: help-osk-build
+    working_dir: /docs
+    command: ["build", "--clean"]
+    restart: "no"
+    volumes:
+      # Whole project (zensical.toml + docs/ + writes public/) on the host.
+      #
+      # NOTE: absolute host path (NOT ./relative). Portainer GitOps runs compose
+      # with paths relative to its own container (/data/compose/<id>/...), which
+      # the Docker daemon can't resolve — relative mounts silently become empty
+      # dirs. Keep /mnt/containers/help-osk-docs in sync with this repo (source
+      # of truth), same as the traefik config.
+      - /mnt/containers/help-osk-docs:/docs:z
+
+  # Static web server. Serves the generated public/ and joins the Traefik
+  # reverse-proxy network; Traefik terminates TLS for help.osk.team.
+  help-osk:
+    image: nginx:alpine
+    container_name: help-osk
+    restart: always
+    depends_on:
+      help-osk-build:
+        condition: service_completed_successfully
+    volumes:
+      - /mnt/containers/help-osk-docs/public:/usr/share/nginx/html:ro,z
+      - /mnt/containers/help-osk-docs/nginx.conf:/etc/nginx/conf.d/default.conf:ro,z
+    networks:
+      - reverseproxy-nw
+
+networks:
+  reverseproxy-nw:
+    external: true