feat(tls): Let's Encrypt via OVH DNS-01 + host nginx vhost

tooling/issue-letsencrypt.sh: manual script, issues one cert per name
(apex + LE_SUBDOMAINS) with acme.sh + OVH DNS-01 (no inbound ports),
installs to certs/<name>/ and reloads nginx. nginx/ulicraft.conf.tmpl:
TLS vhosts for apex/pack (static) + auth (proxy to drasl). OVH creds and
LE_EMAIL in .env.example; certs/ gitignored. plan/15-letsencrypt.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -18,6 +18,19 @@ RCON_PASSWORD=change-me-to-something-random
 # Only needed if using CurseForge-exclusive mods:
 # CF_API_KEY=your-curseforge-api-key
 
+# ── Let's Encrypt via OVH DNS-01 (tooling/issue-letsencrypt.sh) ───────
+# Only needed to issue real TLS certs. DNS-01 needs no inbound ports.
+LE_EMAIL=you@example.com
+# space-separated subdomains; apex ${BASE_DOMAIN} is always included
+LE_SUBDOMAINS=auth pack
+# OVH API creds (DNS zone write). Create at https://eu.api.ovh.com/createToken/
+# OVH_CK can be blank on first run — acme.sh prints an auth URL, then paste it.
+OVH_END_POINT=ovh-eu
+OVH_AK=
+OVH_AS=
+OVH_CK=
+# LE_STAGING=1   # use the untrusted staging CA for dry runs
+
 # ── Blessing Skin auth variant (docker-compose.blessingskin.yml) ──────
 # Only needed when running the Blessing Skin override instead of Drasl.
 BS_DB_NAME=blessingskin