feat(ingress): public distribution.${BASE_DOMAIN} static vhost

Serve a static site at distribution.${BASE_DOMAIN} whose web root lives in
another repo (DISTRIBUTION_WEB_ROOT, bind-mounted read-only into caddy):
  - caddy/conf.d/30-distribution.caddy  file_server vhost
  - docker-compose.distribution.yml     mount snippet + external web root
  - issue-letsencrypt.sh / .env.example add distribution to LE_SUBDOMAINS
  - ulicraft-caddy.conf.tmpl            TLS-front block proxying to caddy

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -23,8 +23,13 @@ RCON_PASSWORD=change-me-to-something-random
 #   CADDY_HTTP_PORT=8880
 #   CADDY_HTTP_BIND=127.0.0.1
 # Then render nginx/ulicraft-caddy.conf.tmpl with CADDY_HTTP_PORT.
-# CADDY_HTTP_PORT=80
-# CADDY_HTTP_BIND=0.0.0.0
+CADDY_HTTP_PORT=80
+CADDY_HTTP_BIND=0.0.0.0
+
+# distribution.${BASE_DOMAIN} static vhost (docker-compose.distribution.yml).
+# Absolute host path to the built static site — it lives in ANOTHER repo.
+# Bind-mounted read-only into caddy and served at distribution.${BASE_DOMAIN}.
+DISTRIBUTION_WEB_ROOT=/home/oier/projects/mc-mods/ulicraft-group/ulicraft-distribution/dist
 # Only needed if using CurseForge-exclusive mods:
 # CF_API_KEY=your-curseforge-api-key
 
@@ -32,7 +37,7 @@ RCON_PASSWORD=change-me-to-something-random
 # Only needed to issue real TLS certs. DNS-01 needs no inbound ports.
 LE_EMAIL=you@example.com
 # space-separated subdomains; apex ${BASE_DOMAIN} is always included
-LE_SUBDOMAINS=auth pack
+LE_SUBDOMAINS=auth pack distribution
 # OVH API creds (DNS zone write). Create at https://eu.api.ovh.com/createToken/
 # OVH_CK can be blank on first run — acme.sh prints an auth URL, then paste it.
 OVH_END_POINT=ovh-eu