feat(compose): optional static/mirror via override files; build-stack up modes

Base compose is core only (dnsmasq, drasl, minecraft, mc-backup, caddy
auth+packwiz). docker-compose.static.yml and docker-compose.mirror.yml layer
on the landing site and the air-gap mirror independently. build-stack.sh --up
[core|static|mirror|full] selects the override files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.mirror.yml

@@ -0,0 +1,12 @@
+# Mirror toggle — full client air-gap upstream mirror (see plan/11).
+# Layer on top of the base: `docker compose -f docker-compose.yml -f docker-compose.mirror.yml up -d`
+# (or `tooling/build-stack.sh --up mirror`). Adds the mirror vhost snippet, the
+# upstream content mount, and publishes :443 for Caddy's `tls internal` certs.
+# Populate the mirror first: tooling/mirror-airgap.sh (+ the proxy-capture step).
+services:
+  caddy:
+    ports:
+      - "443:443"
+    volumes:
+      - ./caddy/conf.d/20-mirror.caddy:/etc/caddy/conf.d/20-mirror.caddy:ro
+      - ./mirror/upstream:/srv/mirror:ro