feat(compose): optional static/mirror via override files; build-stack up modes

Base compose is core only (dnsmasq, drasl, minecraft, mc-backup, caddy
auth+packwiz). docker-compose.static.yml and docker-compose.mirror.yml layer
on the landing site and the air-gap mirror independently. build-stack.sh --up
[core|static|mirror|full] selects the override files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -29,27 +29,28 @@ services:
     #   HTTP_USER: "admin"
     #   HTTP_PASS: "change-me"
 
+  # Core ingress. Static site + air-gap mirror are layered in via override
+  # files (docker-compose.static.yml / .mirror.yml) — see build-stack.sh --up.
   caddy:
     image: caddy:alpine
     container_name: caddy
     restart: unless-stopped
     ports:
       - "80:80"
-      - "443:443"              # tls internal — air-gap mirror vhosts (see 11)
     environment:
       BASE_DOMAIN: ${BASE_DOMAIN}
     volumes:
       - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
-      - ./www:/srv/www:ro
+      - ./caddy/conf.d/00-core.caddy:/etc/caddy/conf.d/00-core.caddy:ro
       - ./pack:/srv/pack:ro
-      - ./mirror/launcher:/srv/launcher:ro
-      - ./mirror/upstream:/srv/mirror:ro   # byte-exact upstream mirror (see 11)
     networks:
       mcnet:
+        # All subdomain aliases live here (harmless when a vhost snippet isn't
+        # mounted; lets internal containers resolve them to Caddy). The spoof
+        # hosts only actually serve content when the mirror snippet is present.
         aliases:
           - "auth.${BASE_DOMAIN}"
           - "packwiz.${BASE_DOMAIN}"
-          # Air-gap spoof hosts -> Caddy, so internal containers resolve them too.
           - "meta.prismlauncher.org"
           - "piston-meta.mojang.com"
           - "piston-data.mojang.com"