Protect Critical Stacks

Protect Critical Stacks

To prevent important compose projects from being stopped or recreated by accident, list them in the server profile:

## Protected Resources
- critical_compose_projects: db, monitoring
- protected_paths: /etc, /root/.ssh

After that, /compose-down and /compose-update require the token --confirm=<project> for those projects:

/compose-down homeserver db --confirm=db

The token makes intent visible and guards against accidental runs. For non-interactive workflows there is FM_CONFIRM_CRITICAL=yes.