refactor!: unify into one compose, drop airgap/mirror/dnsmasq/avahi/blessingskin

Collapse the override-file matrix into a single docker-compose.yml holding the
whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is
now just `docker compose up -d --build`.

Removed features (dead-ends for this deployment):
- airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy,
  caddy local-CA export, /ca.crt)
- dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS;
  DNS is now handled outside this repo (HOST_LAN_IP dropped)
- Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env)
- host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl)
- build-stack.sh and its run modes (online/airgap/core)

Production ingress is the only path now: host nginx terminates TLS (LE certs)
in front of caddy on a localhost-only port; caddy routes every vhost by Host
header. Launcher downloads move mirror/launcher -> launcher/.

Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs
(dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes)
deleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plan/04-packwiz.md

@@ -1,4 +1,4 @@
-# packwiz — modpack source of truth + offline mod mirror
+# packwiz — modpack source of truth
 
 ## Summary
 
@@ -7,30 +7,21 @@ directory is the **single source of truth** for mods, consumed by both:
 - the **server** (itzg `PACKWIZ_URL`), and
 - **clients** (Fjord launcher imports the pack / packwiz-installer).
 
-Caddy serves `./pack` at `packwiz.ulicraft.local`. packwiz only emits **metadata**
+Caddy serves `./pack` at `pack.ulicraft.net`. packwiz emits **metadata**
 (`pack.toml`, `index.toml`, `mods/*.pw.toml`); the `.pw.toml` files reference
-Modrinth/CF **CDN URLs**, so true offline requires mirroring jars locally.
+Modrinth/CF **CDN URLs**, so server and clients fetch the jars from those CDNs.
+The stack assumes the internet is present.
 
 ## Behaviors confirmed
 
 - **Prune**: packwiz-installer tracks a manifest and **removes** client mods no
   longer in the index on re-run. (Server side via itzg likewise re-syncs.)
-- **Download source**: jars come from CDN URLs in `.pw.toml`, NOT the pack host —
-  unless URLs are rewritten to the local mirror.
+- **Download source**: jars come from the CDN URLs in `.pw.toml`, not the pack
+  host (which serves only metadata).
 - **itzg side filtering**: itzg downloads **server-side mods only**. Client-only
   mods MUST be tagged `side = "client"` (not `both`) or the server may pull and
   crash on them.
 
-## Offline mod mirror (the key work)
-
-`tooling/mirror-mods.sh` (see `08-tooling.md`):
-1. Parse each `mods/*.pw.toml`, download the jar into `./mirror/mods/`.
-2. Copy jars into `./pack/mods-files/` (served at `packwiz.ulicraft.local/...`).
-3. Rewrite each `[download] url` to point at `http://packwiz.ulicraft.local/...`.
-4. `packwiz refresh` to recompute hashes/index.
-
-Result: server + clients install mods entirely from the LAN. No CDN at party time.
-
 ## NeoForge pinning
 
 `pack.toml` pins MC `1.21.1` + NeoForge `21.1.x`. Verify exact NeoForge build
@@ -42,7 +33,5 @@ against projects.neoforged.net before locking.
 - [ ] Curate mod shortlist (perf/tech/magic/storage/QoL/worldgen/map/voice)
 - [ ] Tag client-only mods `side = "client"`
 - [ ] `packwiz refresh`; verify `index.toml` committed (clients fetch it)
-- [ ] Write `tooling/mirror-mods.sh` (vendor jars + rewrite URLs + refresh)
-- [ ] Point server `PACKWIZ_URL=http://packwiz.ulicraft.local/pack.toml`
-- [ ] `.gitignore` the vendored `./mirror/` jars; keep `./pack/*.toml` tracked
-- [ ] Test offline install end-to-end (cut internet, install on a fresh client)
+- [ ] Point server `PACKWIZ_URL=http://pack.ulicraft.net/pack.toml`
+- [ ] Test install end-to-end on a fresh client