refactor!: unify into one compose, drop airgap/mirror/dnsmasq/avahi/blessingskin

Collapse the override-file matrix into a single docker-compose.yml holding the
whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is
now just `docker compose up -d --build`.

Removed features (dead-ends for this deployment):
- airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy,
  caddy local-CA export, /ca.crt)
- dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS;
  DNS is now handled outside this repo (HOST_LAN_IP dropped)
- Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env)
- host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl)
- build-stack.sh and its run modes (online/airgap/core)

Production ingress is the only path now: host nginx terminates TLS (LE certs)
in front of caddy on a localhost-only port; caddy routes every vhost by Host
header. Launcher downloads move mirror/launcher -> launcher/.

Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs
(dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes)
deleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

caddy/Caddyfile

@@ -1,10 +1,12 @@
-# Base Caddy config. Vhosts live in conf.d/*.caddy snippets that are mounted
-# in selectively so the stack can run with or without the static site / mirror:
-#   conf.d/00-core.caddy    auth + packwiz   (always — core ingress)
-#   conf.d/10-static.caddy   apex landing + launcher downloads   (static toggle)
-#   conf.d/20-mirror.caddy   air-gap upstream mirror (tls internal)   (mirror toggle)
-# auto_https disable_redirects: http:// sites stay plaintext on :80; the mirror
-# snippet's hosts still get internal TLS on :443 when that snippet is present.
+# Base Caddy config. Vhosts live in conf.d/*.caddy snippets:
+#   conf.d/00-core.caddy          auth + packwiz
+#   conf.d/10-static.caddy        apex landing + launcher downloads
+#   conf.d/30-distribution.caddy  static site from another repo
+#   conf.d/40-avatar.caddy        nmsr skin/avatar renderer
+#   conf.d/50-status.caddy        uptime-kuma status page
+# All snippets are plain http:// on :80 — the host's nginx terminates TLS in
+# front (nginx/ulicraft-caddy.conf.tmpl). disable_redirects keeps caddy from
+# upgrading to its own https.
 {
 	auto_https disable_redirects
 }