refactor!: unify into one compose, drop airgap/mirror/dnsmasq/avahi/blessingskin

Collapse the override-file matrix into a single docker-compose.yml holding the
whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is
now just `docker compose up -d --build`.

Removed features (dead-ends for this deployment):
- airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy,
  caddy local-CA export, /ca.crt)
- dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS;
  DNS is now handled outside this repo (HOST_LAN_IP dropped)
- Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env)
- host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl)
- build-stack.sh and its run modes (online/airgap/core)

Production ingress is the only path now: host nginx terminates TLS (LE certs)
in front of caddy on a localhost-only port; caddy routes every vhost by Host
header. Launcher downloads move mirror/launcher -> launcher/.

Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs
(dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes)
deleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plan/05-minecraft.md

@@ -1,39 +1,30 @@
-# Minecraft server — itzg NeoForge + offline launch
+# Minecraft server — itzg NeoForge
 
 ## Summary
 
 `itzg/minecraft-server:java21`, NeoForge 1.21.1, offline-mode + authlib-injector
-pointing at drasl. Mods via `PACKWIZ_URL`. The challenge: **itzg re-resolves Mojang
-version metadata on every boot** (issue #2340), so it cannot air-gap-boot in
-`TYPE=NEOFORGE` mode. Solved with a pre-bake + custom-launch switch.
+pointing at drasl. Mods via `PACKWIZ_URL`. itzg installs MC + NeoForge +
+libraries + server mods on first boot and re-syncs on restart; the stack assumes
+the internet is present, so `TYPE=NEOFORGE` boots normally every time.
 
-## Offline strategy (two phases)
+## Server config
 
-**Phase 1 — pre-bake (online, once):**
 ```
 TYPE=NEOFORGE, VERSION=1.21.1, NEOFORGE_VERSION=21.1.x
-PACKWIZ_URL=http://packwiz.ulicraft.local/pack.toml
+PACKWIZ_URL=http://pack.${BASE_DOMAIN}/pack.toml
 ```
-Boot once with internet → installs MC + NeoForge + libraries + server mods into
-the `mc_data` volume, generates NeoForge's launch args/`run.sh`.
 
-**Phase 2 — offline launch (party):**
-Switch to `TYPE=CUSTOM` + `CUSTOM_SERVER=<container path>` pointing at the
-already-installed NeoForge launcher in `/data`. A **container path (not URL)**
-means no download, no Mojang resolution → boots air-gapped, survives restarts.
+First boot installs MC + NeoForge + libraries + server mods into the `mc_data`
+volume. Subsequent boots re-sync the pack against `PACKWIZ_URL`.
 
-> OPEN: NeoForge 1.21.1 launches via `@libraries/.../unix_args.txt` / `run.sh`,
-> not a single fat jar. Exact `CUSTOM_SERVER` target + any `EXTRA_ARGS` must be
-> verified against a real pre-baked volume. Tracked as a task.
-
-## Auth / config (carry-over)
+## Auth / config
 
 ```
 ONLINE_MODE=FALSE
 ENFORCE_SECURE_PROFILE=FALSE                 # pairs with drasl SignPublicKeys=false
 JVM_OPTS=-javaagent:/extras/authlib-injector.jar=http://auth.${BASE_DOMAIN}/authlib-injector
 ```
-authlib URL uses the `auth` subdomain; resolves internally via Caddi alias.
+authlib URL uses the `auth` subdomain; resolves internally via the caddy alias.
 (Server still needs the agent even though Fjord clients have it built in.)
 
 Memory: `INIT_MEMORY 4G`, `MAX_MEMORY 10G`, `USE_AIKAR_FLAGS TRUE`.
@@ -41,12 +32,9 @@ RCON enabled for mc-backup.
 
 ## Tasks
 
-- [ ] Compose: switch authlib URL to `http://auth.${BASE_DOMAIN}/authlib-injector`
-- [ ] Compose: replace `MODRINTH_PROJECTS` with `PACKWIZ_URL` (packwiz subdomain)
-- [ ] Mount renamed `./runtime` (was `./extras`) for authlib-injector.jar
+- [ ] Compose: authlib URL `http://auth.${BASE_DOMAIN}/authlib-injector`
+- [ ] Compose: `PACKWIZ_URL=http://pack.${BASE_DOMAIN}/pack.toml`
+- [ ] Mount `./runtime` for authlib-injector.jar at `/extras`
 - [ ] `depends_on`: drasl + caddy (pack served before server installs)
-- [ ] Pre-bake the volume online; snapshot it
-- [ ] Identify exact NeoForge launch target for `TYPE=CUSTOM` / `CUSTOM_SERVER`
-- [ ] Add a documented "offline mode" compose override (`docker-compose.offline.yml`?)
-- [ ] Verify air-gapped boot: cut internet, restart container, server comes up
 - [ ] Confirm `ENFORCE_SECURE_PROFILE=FALSE` ↔ drasl `SignPublicKeys=false`
+- [ ] Verify a client joins with their drasl skin