feat(ingress): public distribution.${BASE_DOMAIN} static vhost

Serve a static site at distribution.${BASE_DOMAIN} whose web root lives in
another repo (DISTRIBUTION_WEB_ROOT, bind-mounted read-only into caddy):
  - caddy/conf.d/30-distribution.caddy  file_server vhost
  - docker-compose.distribution.yml     mount snippet + external web root
  - issue-letsencrypt.sh / .env.example add distribution to LE_SUBDOMAINS
  - ulicraft-caddy.conf.tmpl            TLS-front block proxying to caddy

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

caddy/conf.d/30-distribution.caddy

@@ -0,0 +1,8 @@
+# Distribution toggle — static site served from a web root in ANOTHER repo.
+# The host path is set by DISTRIBUTION_WEB_ROOT in .env and bind-mounted to
+# /srv/distribution by docker-compose.caddy.yml. Mounted only when that var is
+# set (see the distribution override).
+http://distribution.{$BASE_DOMAIN} {
+	root * /srv/distribution
+	file_server browse
+}