refactor: use $DOMAIN env var instead of hardcoded lazyworkhorse.net

Replace all hardcoded lazyworkhorse.net references in compose files
with ${DOMAIN} variable substitution. Create .env.production and
.env.staging environment files. Update Makefile with ENV selection
(--env-file support) and staging/production targets.

Changes:
- All 13 compose YAML files: lazyworkhorse.net -> ${DOMAIN}
- New .env.production (DOMAIN=lazyworkhorse.net)
- New .env.staging (DOMAIN=staging.lazyworkhorse.net)
- Makefile: ENV var, --env-file flag, staging/production targets
- Gitea redirect regex updated for variable substitution
- CI workflow checkout URLs left hardcoded (infrastructure refs)
- Dockerfile SSH host refs left hardcoded (infrastructure refs)

Deploy: make ENV=staging all_up  or  make staging
        make ENV=production all_up  or  make production

ai/compose.yml

@@ -15,12 +15,12 @@ services:
   #     - "traefik.enable=true"
 
   #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-http.rule=Host(`ai.${DOMAIN}`)"
   #     - "traefik.http.routers.webui-http.entrypoints=web"
   #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
 
   #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-https.rule=Host(`ai.${DOMAIN}`)"
   #     - "traefik.http.routers.webui-https.entrypoints=websecure"
   #     - "traefik.http.routers.webui-https.tls=true"
   #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
@@ -87,10 +87,10 @@ services:
       - ai_net
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.${DOMAIN}`)"
       - "traefik.http.routers.syncthing-http.entrypoints=web"
       - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
-      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.${DOMAIN}`)"
       - "traefik.http.routers.syncthing-https.entrypoints=websecure"
       - "traefik.http.routers.syncthing-https.tls=true"
       - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
@@ -232,12 +232,12 @@ networks:
   #   networks:
   #     - ai_net
   #   environment:
-  #     - N8N_HOST=n8n.lazyworkhorse.net
+  #     - N8N_HOST=n8n.${DOMAIN}
   #     - N8N_PORT=5678
   #     - N8N_PROTOCOL=https
   #     - NODE_ENV=production
   #     - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
-  #     - WEBHOOK_URL=https://n8n.lazyworkhorse.net/
+  #     - WEBHOOK_URL=https://n8n.${DOMAIN}/
   #     - GENERIC_TIMEZONE=America/New_York # Adjust to your timezone
   #     - N8N_BLOCK_EXTERNAL_STORAGE_ACCESS=false
   #     - N8N_NODES_PYTHON_CAN_IMPORT_MODULES=true 
@@ -251,12 +251,12 @@ networks:
   #     - "traefik.enable=true"
 
   #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.${DOMAIN}`)"
   #     - "traefik.http.routers.n8n-http.entrypoints=web"
   #     - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"
 
   #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.${DOMAIN}`)"
   #     - "traefik.http.routers.n8n-https.entrypoints=websecure"
   #     - "traefik.http.routers.n8n-https.tls=true"
   #     - "traefik.http.routers.n8n-https.tls.certresolver=njalla"
@@ -286,15 +286,15 @@ networks:
   #     - BROWSER_CDP_URL=http://openclaw-browser:9222
   #     - BROWSER_EVALUATE_ENABLED=true
   #     - OPENCLAW_GATEWAY_HOST=0.0.0.0
-  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
+  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.${DOMAIN}
   #   labels:
   #     - "traefik.enable=true"
 
-  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.${DOMAIN}`)"
   #     - "traefik.http.routers.openclaw-http.entrypoints=web"
   #     - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"
 
-  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.${DOMAIN}`)"
   #     - "traefik.http.routers.openclaw-https.priority=50"
   #     - "traefik.http.routers.openclaw-https.entrypoints=websecure"
   #     - "traefik.http.routers.openclaw-https.tls=true"