refactor(ingress): extract caddy to its own compose file; add nginx path

Caddy is no longer in the base stack. Two ingress paths now:
- docker-compose.caddy.yml — LAN/air-gap; build-stack.sh adds it for all
  up modes + the prep pre-bake. Holds the mcnet auth./pack. aliases.
- docker-compose.nginx.yml — production behind the host's nginx: publishes
  drasl on 127.0.0.1:25585, points minecraft at the host (extra_hosts) over
  HTTPS for pack + authlib.

Base loses the caddy service and minecraft's caddy depends_on (re-added by
caddy.yml). Blessing Skin override now requires caddy.yml (it only swaps
caddy's core conf).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tooling/build-stack.sh

@@ -91,7 +91,8 @@ prep() {
   log "pre-bake server volume (TYPE=NEOFORGE install, one-shot, online)"
   # Bring minecraft up once so itzg installs NeoForge + mods into the volume,
   # then stop it. The party then runs offline against the baked volume.
-  "${COMPOSE[@]}" up -d minecraft
+  # caddy.yml so the pack (pack.${BASE_DOMAIN}) resolves + is served during bake.
+  "${COMPOSE[@]}" -f docker-compose.yml -f docker-compose.caddy.yml up -d minecraft
   warn "watch logs until 'Done' then re-run with --up; or automate a readiness probe"
 }
 
@@ -102,7 +103,10 @@ prep() {
 #   core    base only (no landing, no mirror) — debugging
 up() {
   local mode="${1:-airgap}"
-  local -a files=(-f docker-compose.yml)
+  # build-stack is the caddy (LAN/air-gap) deployer; caddy lives in its own file
+  # now (the base stack can also run behind the host's nginx — see
+  # docker-compose.nginx.yml). Always include caddy here.
+  local -a files=(-f docker-compose.yml -f docker-compose.caddy.yml)
   case "$mode" in
     core)   ;;
     online) files+=(-f docker-compose.static.yml) ;;