feat(avatar): NMSR skin renderer at avatar.${BASE_DOMAIN}, Drasl-backed

Add NMSR-as-a-Service (NickAcPT/nmsr-rs) rendering players' skins/avatars,
sourced from Drasl instead of Mojang.

- docker/nmsr/Dockerfile     build from source, pinned to commit 948ba4bc027b
                             (ears feature, lavapipe software Vulkan)
- nmsr/config.toml.tmpl       [mojank] -> http://auth.${BASE_DOMAIN}; Drasl
                              serves the Mojang-compatible routes at its bare
                              BaseURL and embeds absolute skin URLs that NMSR
                              fetches directly. allow_offline_mode_uuids=true.
- docker-compose.nmsr.yml     nmsr service (build), host bind 127.0.0.1:9898
                              only, config mount; mounts the caddy avatar snippet
- caddy/conf.d/40-avatar.caddy avatar.${BASE_DOMAIN} -> reverse_proxy nmsr:8080
- nginx-front + LE_SUBDOMAINS  public TLS vhost (HSTS) + cert for avatar
- render-config.sh / .gitignore render + ignore nmsr/config.toml

Skin resolution stays internal over mcnet (caddy alias -> drasl), no public
round-trip.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.nmsr.yml

@@ -0,0 +1,32 @@
+# ──────────────────────────────────────────────────────────────────
+# NMSR-aas — avatar/skin renderer at avatar.${BASE_DOMAIN}.
+# ──────────────────────────────────────────────────────────────────
+#   docker compose -f docker-compose.yml -f docker-compose.caddy.yml \
+#     -f docker-compose.nmsr.yml up -d --build
+#
+# Built from source (no upstream image) — see docker/nmsr/Dockerfile.
+# Renders YOUR players' skins by pulling profiles from Drasl over the internal
+# mcnet network (config: nmsr/config.toml, rendered from .tmpl).
+#
+# Caddy reverse-proxies avatar.${BASE_DOMAIN} -> nmsr:8080 internally. The host
+# port is published on 127.0.0.1:9898 ONLY (local debugging / not reachable from
+# outside) — public access goes through nginx -> caddy.
+services:
+  # Mount the avatar vhost snippet into caddy (the caddy override owns the base
+  # config; this adds one more conf.d file like the distribution override does).
+  caddy:
+    volumes:
+      - ./caddy/conf.d/40-avatar.caddy:/etc/caddy/conf.d/40-avatar.caddy:ro
+
+  nmsr:
+    build:
+      context: ./docker/nmsr
+    image: ulicraft/nmsr:local
+    container_name: nmsr
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:9898:8080"
+    volumes:
+      - ./nmsr/config.toml:/nmsr/config.toml:ro
+    networks:
+      - mcnet