refactor!: unify into one compose, drop airgap/mirror/dnsmasq/avahi/blessingskin

Collapse the override-file matrix into a single docker-compose.yml holding the
whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is
now just `docker compose up -d --build`.

Removed features (dead-ends for this deployment):
- airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy,
  caddy local-CA export, /ca.crt)
- dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS;
  DNS is now handled outside this repo (HOST_LAN_IP dropped)
- Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env)
- host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl)
- build-stack.sh and its run modes (online/airgap/core)

Production ingress is the only path now: host nginx terminates TLS (LE certs)
in front of caddy on a localhost-only port; caddy routes every vhost by Host
header. Launcher downloads move mirror/launcher -> launcher/.

Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs
(dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes)
deleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plan/08-tooling.md

@@ -1,77 +1,89 @@
-# Tooling — config rendering, mod mirror, launcher fetch
+# Tooling — config rendering, pack render, ingress, fetch scripts
 
 ## Summary
 
-Three scripts in `./tooling/` turn the two env vars + templates into a working,
-offline-capable stack. All are **cautious**: they halt on unset vars or missing
-inputs rather than emit half-broken output.
+Scripts in `./tooling/` turn `BASE_DOMAIN` + templates into a working stack and
+handle ingress (nginx vhost, TLS certs) and launcher/font fetches. All are
+**cautious**: they halt on unset vars or missing inputs rather than emit
+half-broken output.
+
+Surviving scripts:
+
+- `render-config.sh` — render `*.tmpl` configs (BASE_DOMAIN only)
+- `render-pack.sh` — render packwiz pack templates + index
+- `render-nginx.sh` — render/install the host nginx vhost (TLS terminator → caddy)
+- `issue-letsencrypt.sh` — issue LE certs via OVH DNS-01 (see 15-letsencrypt.md)
+- `fetch-launcher.sh` — download Fjord launcher release assets (see 06-launcher.md)
+- `add-custom-mod.sh` — add a custom (non-CDN) mod to the pack
+- `fetch-fonts.sh` — vendor the landing page fonts (see 09-landing.md)
 
 ## render-config.sh
 
-Renders every `*.tmpl` into its real config by substituting `BASE_DOMAIN` /
-`HOST_LAN_IP`. Caddy is excluded (it reads `{$BASE_DOMAIN}` natively).
+Renders every `*.tmpl` into its real config by substituting **only**
+`${BASE_DOMAIN}` (so literal `$`-syntax belonging to the target file — caddy,
+toml — is left untouched). Caddy is excluded entirely (it reads `{$BASE_DOMAIN}`
+natively).
 
 Targets:
-- `drasl/config/config.toml.tmpl`  → `drasl/config/config.toml`
-- `dnsmasq/dnsmasq.conf.tmpl`       → `dnsmasq/dnsmasq.conf`
+- `drasl/config/config.toml.tmpl` → `drasl/config/config.toml`
+- `nmsr/config.toml.tmpl`         → `nmsr/config.toml`
+
+It then delegates pack templates (`mods/*.pw.toml.tmpl`, CustomSkinLoader, …) +
+the packwiz index to `render-pack.sh` — the single source of pack render.
 
 ```bash
 #!/usr/bin/env bash
 set -euo pipefail
-[ -f .env ] && set -a && . ./.env && set +a
-: "${BASE_DOMAIN:?BASE_DOMAIN unset}"
-: "${HOST_LAN_IP:?HOST_LAN_IP unset}"
+cd "$(dirname "$0")/.."
+[ -f .env ] && { set -a; . ./.env; set +a; }
+: "${BASE_DOMAIN:?BASE_DOMAIN unset (set in .env)}"
 
 render() {  # $1=tmpl  $2=out
-  [ -f "$1" ] || { echo "missing template: $1"; exit 1; }
-  envsubst '${BASE_DOMAIN} ${HOST_LAN_IP}' < "$1" > "$2"
+  [ -f "$1" ] || { echo "missing template: $1" >&2; exit 1; }
+  envsubst '${BASE_DOMAIN}' < "$1" > "$2"
   echo "rendered $2"
 }
 
 render drasl/config/config.toml.tmpl drasl/config/config.toml
-render dnsmasq/dnsmasq.conf.tmpl      dnsmasq/dnsmasq.conf
+render nmsr/config.toml.tmpl          nmsr/config.toml
+tooling/render-pack.sh
 ```
 
-> Note: `envsubst` with an explicit var list avoids clobbering `$`-syntax that
-> belongs to the target file (e.g. dnsmasq/caddy literals).
+## render-nginx.sh
 
-## mirror-mods.sh
+Renders `nginx/ulicraft-caddy.conf.tmpl` (the host nginx that terminates TLS in
+front of caddy), substituting `$BASE_DOMAIN $APP_DIR $CADDY_HTTP_PORT`. Prints to
+stdout by default; `--install` writes to sites-available, symlinks sites-enabled,
+`nginx -t`, and reloads nginx. See `15-letsencrypt.md`.
 
-Vendors mod jars for offline install and rewrites packwiz URLs to the LAN host.
-See `04-packwiz.md`. Outline:
-1. For each `pack/mods/*.pw.toml`, read `[download] url` + `filename`.
-2. Download jar → `pack/mods-files/` (served by Caddy under packwiz subdomain).
-3. Rewrite `url` to `http://packwiz.${BASE_DOMAIN}/mods-files/<filename>`.
-4. `packwiz refresh` to recompute hashes + `index.toml`.
-Must halt if a download fails or a hash mismatches.
+## issue-letsencrypt.sh
 
-## mirror-assets.sh
-
-Mirrors Minecraft asset objects for offline clients (the ~400 MB+ chunk) and lays
-them out for Caddy + the Fjord "Assets Server" override. Full design in
-`10-assets-mirror.md`. Verifies SHA1, idempotent, halts on mismatch.
+Issues a separate cert for the apex and each `LE_SUBDOMAINS` entry via acme.sh +
+OVH DNS-01 → `certs/<name>/{cert,key}.pem`. See `15-letsencrypt.md`.
 
 ## fetch-launcher.sh
 
-Downloads all FjordLauncherUnlocked release assets → `mirror/launcher/<tag>/`.
-Full script in `06-launcher.md`.
+Downloads FjordLauncherUnlocked release assets → `launcher/<tag>/` and maintains
+a `latest` symlink + stable per-OS filename symlinks. Full script in
+`06-launcher.md`.
 
 ## Generated / gitignored
 
 ```
 drasl/config/config.toml      # rendered
-dnsmasq/dnsmasq.conf          # rendered
-pack/mods-files/              # vendored jars
-mirror/                       # launcher assets + mod mirror
+nmsr/config.toml              # rendered
+launcher/                     # launcher assets
+www/                          # landing build output
+certs/                        # Let's Encrypt certs
 .env                          # secrets + host-specific
 ```
 
 ## Tasks
 
 - [ ] Write `tooling/render-config.sh` (above), `chmod +x`
-- [ ] Write `tooling/mirror-mods.sh` (toml parse + download + rewrite + refresh)
-- [ ] Write `tooling/mirror-assets.sh` (see 10)
+- [ ] Write `tooling/render-pack.sh` (pack templates + index)
+- [ ] Write `tooling/render-nginx.sh` (see 15)
+- [ ] Write `tooling/issue-letsencrypt.sh` (see 15)
 - [ ] Write `tooling/fetch-launcher.sh` (see 06)
 - [ ] Add `gettext` (envsubst) + `jq` to host prereqs doc
-- [ ] Update `.gitignore` for rendered configs + `mirror/` + `pack/mods-files/`
-- [ ] `build-stack.sh` orchestrator (preflight + `--prep` online + `--up` offline) — DONE, sequences the sub-scripts; see plan/12
+- [ ] Update `.gitignore` for rendered configs + `launcher/` + `www/` + `certs/`