refactor!: unify into one compose, drop airgap/mirror/dnsmasq/avahi/blessingskin

Collapse the override-file matrix into a single docker-compose.yml holding the
whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is
now just `docker compose up -d --build`.

Removed features (dead-ends for this deployment):
- airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy,
  caddy local-CA export, /ca.crt)
- dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS;
  DNS is now handled outside this repo (HOST_LAN_IP dropped)
- Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env)
- host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl)
- build-stack.sh and its run modes (online/airgap/core)

Production ingress is the only path now: host nginx terminates TLS (LE certs)
in front of caddy on a localhost-only port; caddy routes every vhost by Host
header. Launcher downloads move mirror/launcher -> launcher/.

Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs
(dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes)
deleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plan/03-drasl.md

@@ -4,7 +4,7 @@
 
 Self-hosted, Yggdrasil-compatible auth + skin server. Drop-in Mojang replacement
 via authlib-injector. Image: `unmojang/drasl:latest`. Reached only through Caddy
-at `auth.ulicraft.local`; no host port.
+at `auth.ulicraft.net`; no host port.
 
 **OIDC/Keycloak is OUT for now** — drasl runs in **password-login** mode
 (`AllowPasswordLogin = true`). Admin + guests register with a username/password on
@@ -35,7 +35,7 @@ AllowPasswordLogin = true
 - **1.21+ secure profile**: drasl `SignPublicKeys = false` MUST pair with server
   `ENFORCE_SECURE_PROFILE=FALSE`. Linked — both or neither.
 - **authlib endpoint** = `BaseURL` + `/authlib-injector` →
-  `http://auth.ulicraft.local/authlib-injector`. Must match on server and client.
+  `http://auth.ulicraft.net/authlib-injector`. Must match on server and client.
   Network alias makes this identical inside/outside the stack.
 - **`Domain` affects skins** — if wrong, authlib clients may not see skins.