feat(status): Uptime Kuma monitoring at status.${BASE_DOMAIN}

Add docker-compose.status.yml (louislam/uptime-kuma) layered on the caddy
ingress, joining mcnet so it probes the stack by internal service name and
the public vhosts end-to-end. Host port bound to 127.0.0.1:3001 only; public
access via nginx -> caddy.

- caddy/conf.d/50-status.caddy: status. -> uptime-kuma:3001
- nginx caddy-front template: status. TLS vhost + websocket upgrade headers
  for Kuma's live UI; status. added to the HTTP->HTTPS redirect list
- status added to LE_SUBDOMAINS defaults (.env.example, issue-letsencrypt.sh)
- README: Status monitoring section + recommended monitor list (incl. native
  Minecraft-protocol ping)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -21,6 +21,8 @@ Optional layers (each its own `docker-compose.<name>.yml`):
   `avatar.${BASE_DOMAIN}`, sourced from Drasl. See **Avatar renderer** below.
 - `distribution` — extra static vhost at `distribution.${BASE_DOMAIN}` whose web
   root (`DISTRIBUTION_WEB_ROOT`) lives in another repo.
+- `status` (louislam/uptime-kuma) — uptime monitoring + public status page at
+  `status.${BASE_DOMAIN}`. See **Status monitoring** below.
 
 Config lives in `.env`: `BASE_DOMAIN` (default `ulicraft.lan`), `HOST_LAN_IP`,
 `RCON_PASSWORD`, `ENABLE_MDNS`. Services are subdomains: `auth.`, `packwiz.`,
@@ -96,7 +98,7 @@ nmsr). HTTPS-only: HTTP 301s to HTTPS and every TLS vhost sends HSTS.
 1. **Issue certs** (OVH DNS-01, no inbound ports needed):
    ```sh
    # .env: BASE_DOMAIN, LE_EMAIL, OVH_* creds,
-   #   LE_SUBDOMAINS="auth pack distribution www avatar"
+   #   LE_SUBDOMAINS="auth pack distribution www avatar status"
    tooling/issue-letsencrypt.sh        # → certs/<name>/{cert,key}.pem
    ```
 
@@ -110,7 +112,7 @@ nmsr). HTTPS-only: HTTP 301s to HTTPS and every TLS vhost sends HSTS.
    ```sh
    docker compose -f docker-compose.yml -f docker-compose.caddy.yml \
      -f docker-compose.static.yml -f docker-compose.distribution.yml \
-     -f docker-compose.nmsr.yml up -d --build
+     -f docker-compose.nmsr.yml -f docker-compose.status.yml up -d --build
    ```
 
 4. **Render + install the nginx vhost** with `tooling/render-nginx.sh`. It pulls
@@ -153,6 +155,40 @@ Vulkan); if renders fail, check `docker logs nmsr` for Vulkan device init.
 another repo: set `DISTRIBUTION_WEB_ROOT` (absolute host path) in `.env`; it's
 bind-mounted read-only via `docker-compose.distribution.yml`.
 
+## Status monitoring (Uptime Kuma)
+
+`status.${BASE_DOMAIN}` runs [Uptime Kuma](https://github.com/louislam/uptime-kuma)
+— uptime probes for every vhost **and** a native Minecraft-protocol ping (player
+count + up/down), plus a public status page. The container joins `mcnet`, so it
+can probe the stack by internal service name without leaving the host. caddy
+reverse-proxies `status.` → `uptime-kuma:3001`; the host port is published on
+`127.0.0.1:3001` only (first-run admin setup / local debugging).
+
+Bring up (layer on the caddy ingress):
+
+```sh
+docker compose -f docker-compose.yml -f docker-compose.caddy.yml \
+  -f docker-compose.status.yml up -d
+```
+
+Then open `https://status.${BASE_DOMAIN}` (or `http://127.0.0.1:3001` first run),
+create the admin account, and add monitors. Kuma has no config-as-code — add
+these once via the UI (data persists in the `kuma_data` volume):
+
+| Monitor | Type | Target |
+|---|---|---|
+| Minecraft | Minecraft Server | `minecraft` : `25565` |
+| Drasl auth | HTTP(s) | `https://auth.${BASE_DOMAIN}` |
+| Landing (apex) | HTTP(s) | `https://${BASE_DOMAIN}` |
+| Packwiz | HTTP(s) | `https://pack.${BASE_DOMAIN}` |
+| Distribution | HTTP(s) | `https://distribution.${BASE_DOMAIN}` |
+| Avatar (NMSR) | HTTP(s) | `https://avatar.${BASE_DOMAIN}` |
+
+Internal-name targets (`minecraft`, `drasl:25585`, `nmsr:8080`) isolate "service
+down" from "ingress/TLS/DNS down"; public-URL targets test the whole chain. Mix
+as you like. `status` is in the default `LE_SUBDOMAINS` so its TLS cert issues
+with the rest; the nginx vhost adds websocket upgrade headers for Kuma's live UI.
+
 ## Join (guests)
 
 1. Open `http://ulicraft.lan`, download FjordLauncherUnlocked for your OS.