refactor!: unify into one compose, drop airgap/mirror/dnsmasq/avahi/blessingskin

Collapse the override-file matrix into a single docker-compose.yml holding the
whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is
now just `docker compose up -d --build`.

Removed features (dead-ends for this deployment):
- airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy,
  caddy local-CA export, /ca.crt)
- dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS;
  DNS is now handled outside this repo (HOST_LAN_IP dropped)
- Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env)
- host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl)
- build-stack.sh and its run modes (online/airgap/core)

Production ingress is the only path now: host nginx terminates TLS (LE certs)
in front of caddy on a localhost-only port; caddy routes every vhost by Host
header. Launcher downloads move mirror/launcher -> launcher/.

Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs
(dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes)
deleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

caddy/conf.d/00-core-blessingskin.caddy

@@ -1,14 +0,0 @@
-# Core ingress — Blessing Skin variant. Replaces 00-core.caddy when the
-# docker-compose.blessingskin.yml override is in play (mounted at the same
-# target path). auth.* now points at Blessing Skin instead of Drasl.
-#
-# Blessing Skin serves BOTH its web UI (/) and the Yggdrasil API (/api/yggdrasil)
-# on the same vhost, so a single reverse_proxy covers everything.
-http://auth.{$BASE_DOMAIN} {
-	reverse_proxy blessing-skin:80
-}
-
-http://pack.{$BASE_DOMAIN} {
-	root * /srv/pack
-	file_server browse
-}

caddy/conf.d/10-static.caddy

@@ -1,13 +1,5 @@
-# Static toggle — apex landing page + launcher downloads.
-# Mounted only when the stack runs with static files (build-stack.sh up static|full).
+# Apex — landing page (/srv/www) + launcher downloads (/srv/launcher).
 http://{$BASE_DOMAIN} {
-	# Caddy's local CA root, so guests can trust the air-gap HTTPS mirror.
-	# Mounted from ./caddy/caddy-root-ca.crt (exported by build-stack prep;
-	# the live pki dir is root-only 0600 and can't be served directly).
-	handle /ca.crt {
-		root * /srv/ca-pub
-		file_server
-	}
 	# Launcher downloads are a sibling mount (/srv/launcher), not nested under
 	# the read-only /srv/www. handle_path strips the /launcher prefix.
 	handle_path /launcher/* {

caddy/conf.d/20-mirror.caddy

@@ -1,9 +0,0 @@
-# Mirror toggle — full client air-gap mirror (see plan/11-full-airgap-mirror.md).
-# Byte-exact copies of the real upstream hosts over HTTPS with Caddy's local CA.
-# dnsmasq spoofs these hostnames -> our host; {host} roots each at its subtree.
-# Mounted only when the stack runs with the mirror (build-stack.sh up mirror|full).
-meta.prismlauncher.org, piston-meta.mojang.com, piston-data.mojang.com, libraries.minecraft.net, maven.neoforged.net, resources.download.minecraft.net {
-	tls internal
-	root * /srv/mirror/{host}
-	file_server
-}

caddy/conf.d/30-distribution.caddy

@@ -1,7 +1,6 @@
-# Distribution toggle — static site served from a web root in ANOTHER repo.
-# The host path is set by DISTRIBUTION_WEB_ROOT in .env and bind-mounted to
-# /srv/distribution by docker-compose.caddy.yml. Mounted only when that var is
-# set (see the distribution override).
+# Distribution — static site served from a web root in ANOTHER repo. The host
+# path is set by DISTRIBUTION_WEB_ROOT in .env and bind-mounted to
+# /srv/distribution by the caddy service in docker-compose.yml.
 http://distribution.{$BASE_DOMAIN} {
 	root * /srv/distribution
 	file_server browse

caddy/conf.d/40-avatar.caddy

@@ -1,5 +1,4 @@
-# Avatar toggle — NMSR skin/avatar renderer (docker-compose.nmsr.yml).
-# Mounted only when the nmsr override is present.
+# Avatar — NMSR skin/avatar renderer (nmsr service), Drasl-backed.
 http://avatar.{$BASE_DOMAIN} {
 	reverse_proxy nmsr:8080
 }

caddy/conf.d/50-status.caddy

@@ -1,5 +1,4 @@
-# Status toggle — Uptime Kuma monitoring + public status page
-# (docker-compose.status.yml). Mounted only when the status override is present.
+# Status — Uptime Kuma monitoring + public status page (uptime-kuma service).
 http://status.{$BASE_DOMAIN} {
 	reverse_proxy uptime-kuma:3001
 }