refactor!: unify into one compose, drop airgap/mirror/dnsmasq/avahi/blessingskin

Collapse the override-file matrix into a single docker-compose.yml holding the
whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is
now just `docker compose up -d --build`.

Removed features (dead-ends for this deployment):
- airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy,
  caddy local-CA export, /ca.crt)
- dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS;
  DNS is now handled outside this repo (HOST_LAN_IP dropped)
- Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env)
- host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl)
- build-stack.sh and its run modes (online/airgap/core)

Production ingress is the only path now: host nginx terminates TLS (LE certs)
in front of caddy on a localhost-only port; caddy routes every vhost by Host
header. Launcher downloads move mirror/launcher -> launcher/.

Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs
(dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes)
deleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitignore

@@ -6,15 +6,14 @@ runtime/authlib-injector.jar
 # rendered configs (from tooling/render-config.sh)
 drasl/config/config.toml
 nmsr/config.toml
-dnsmasq/dnsmasq.conf
 # packwiz pack files rendered from pack/**/*.tmpl by tooling/render-pack.sh
 # (domain-dependent build output); source of truth is the .tmpl + custom/ jars.
 pack/mods/*.pw.toml
 pack/index.toml
 pack/CustomSkinLoader/CustomSkinLoader.json
 
-# vendored / mirrored binaries
-mirror/
+# vendored binaries
+launcher/
 pack/mods-files/
 
 # landing page: generated build output + deps
@@ -23,8 +22,5 @@ landing/node_modules/
 landing/.astro/
 landing/dist/
 
-# exported Caddy CA (per-deploy artifact)
-caddy/caddy-root-ca.crt
-
 # Let's Encrypt certs + private keys (issued by tooling/issue-letsencrypt.sh)
 certs/