feat(avatar): NMSR skin renderer at avatar.${BASE_DOMAIN}, Drasl-backed

Add NMSR-as-a-Service (NickAcPT/nmsr-rs) rendering players' skins/avatars,
sourced from Drasl instead of Mojang.

- docker/nmsr/Dockerfile     build from source, pinned to commit 948ba4bc027b
                             (ears feature, lavapipe software Vulkan)
- nmsr/config.toml.tmpl       [mojank] -> http://auth.${BASE_DOMAIN}; Drasl
                              serves the Mojang-compatible routes at its bare
                              BaseURL and embeds absolute skin URLs that NMSR
                              fetches directly. allow_offline_mode_uuids=true.
- docker-compose.nmsr.yml     nmsr service (build), host bind 127.0.0.1:9898
                              only, config mount; mounts the caddy avatar snippet
- caddy/conf.d/40-avatar.caddy avatar.${BASE_DOMAIN} -> reverse_proxy nmsr:8080
- nginx-front + LE_SUBDOMAINS  public TLS vhost (HSTS) + cert for avatar
- render-config.sh / .gitignore render + ignore nmsr/config.toml

Skin resolution stays internal over mcnet (caddy alias -> drasl), no public
round-trip.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tooling/issue-letsencrypt.sh

@@ -17,7 +17,7 @@
 #   OVH_CK            OVH consumer key (obtained on first run — see below)
 #   OVH_END_POINT     OVH API endpoint (e.g. ovh-eu)
 # optional:
-#   LE_SUBDOMAINS     space-separated (default: "auth pack distribution www")
+#   LE_SUBDOMAINS     space-separated (default: "auth pack distribution www avatar")
 #   LE_STAGING=1      use the LE staging CA (untrusted, for dry runs)
 #
 # First-time OVH consumer key: set OVH_AK/OVH_AS/OVH_END_POINT, leave OVH_CK
@@ -53,7 +53,7 @@ ACME="${ACME_SH:-$HOME/.acme.sh/acme.sh}"
 then re-run (or set ACME_SH=/path/to/acme.sh)."
 
 CERT_DIR="${CERT_DIR:-certs}"
-read -r -a SUBDOMAINS <<< "${LE_SUBDOMAINS:-auth pack distribution www}"
+read -r -a SUBDOMAINS <<< "${LE_SUBDOMAINS:-auth pack distribution www avatar}"
 
 if [ "${LE_STAGING:-0}" = "1" ]; then
   SERVER="letsencrypt_test"; warn "STAGING mode — certs will NOT be trusted by browsers"

tooling/render-config.sh

@@ -18,6 +18,7 @@ render() {  # $1=template  $2=output
 }
 
 render drasl/config/config.toml.tmpl drasl/config/config.toml
+render nmsr/config.toml.tmpl          nmsr/config.toml
 render dnsmasq/dnsmasq.conf.tmpl      dnsmasq/dnsmasq.conf
 
 # pack templates (mods/*.pw.toml.tmpl, CustomSkinLoader, …) + packwiz index.