refactor(ingress): extract caddy to its own compose file; add nginx path

Caddy is no longer in the base stack. Two ingress paths now:
- docker-compose.caddy.yml — LAN/air-gap; build-stack.sh adds it for all
  up modes + the prep pre-bake. Holds the mcnet auth./pack. aliases.
- docker-compose.nginx.yml — production behind the host's nginx: publishes
  drasl on 127.0.0.1:25585, points minecraft at the host (extra_hosts) over
  HTTPS for pack + authlib.

Base loses the caddy service and minecraft's caddy depends_on (re-added by
caddy.yml). Blessing Skin override now requires caddy.yml (it only swaps
caddy's core conf).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.nginx.yml

@@ -0,0 +1,30 @@
+# ──────────────────────────────────────────────────────────────────
+# Production ingress = the HOST's nginx + Let's Encrypt. No caddy.
+# ──────────────────────────────────────────────────────────────────
+#   docker compose -f docker-compose.yml -f docker-compose.nginx.yml up -d
+#
+# nginx (on the host, already installed) terminates TLS with the LE certs from
+# tooling/issue-letsencrypt.sh and:
+#   - serves apex + pack.${BASE_DOMAIN} as static files (./www, ./pack, ./custom)
+#   - reverse-proxies auth.${BASE_DOMAIN} -> 127.0.0.1:25585 (drasl)
+# See nginx/ulicraft.conf.tmpl.
+#
+# This override:
+#   - publishes drasl on localhost so the host nginx can reach it
+#   - points the minecraft container at the host (extra_hosts) over HTTPS, so it
+#     fetches the pack and validates sessions through the same public names the
+#     LE certs cover (JVM trusts Let's Encrypt out of the box)
+services:
+  drasl:
+    ports:
+      - "127.0.0.1:25585:25585"
+
+  minecraft:
+    # Make the public names resolve to the host running nginx.
+    extra_hosts:
+      - "auth.${BASE_DOMAIN}:host-gateway"
+      - "pack.${BASE_DOMAIN}:host-gateway"
+    environment:
+      # Use HTTPS now that nginx terminates TLS with a publicly-trusted cert.
+      JVM_OPTS: "-javaagent:/extras/authlib-injector.jar=https://auth.${BASE_DOMAIN}/authlib-injector"
+      PACKWIZ_URL: "https://pack.${BASE_DOMAIN}/pack.toml"