feat(status): Uptime Kuma monitoring at status.${BASE_DOMAIN}

Add docker-compose.status.yml (louislam/uptime-kuma) layered on the caddy
ingress, joining mcnet so it probes the stack by internal service name and
the public vhosts end-to-end. Host port bound to 127.0.0.1:3001 only; public
access via nginx -> caddy.

- caddy/conf.d/50-status.caddy: status. -> uptime-kuma:3001
- nginx caddy-front template: status. TLS vhost + websocket upgrade headers
  for Kuma's live UI; status. added to the HTTP->HTTPS redirect list
- status added to LE_SUBDOMAINS defaults (.env.example, issue-letsencrypt.sh)
- README: Status monitoring section + recommended monitor list (incl. native
  Minecraft-protocol ping)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.status.yml

@@ -0,0 +1,36 @@
+# ──────────────────────────────────────────────────────────────────
+# Uptime Kuma — status/monitoring for every vhost + the Minecraft server,
+# reachable at status.${BASE_DOMAIN}.
+# ──────────────────────────────────────────────────────────────────
+#   docker compose -f docker-compose.yml -f docker-compose.caddy.yml \
+#     -f docker-compose.status.yml up -d
+#
+# Joins mcnet so monitors can probe the stack BY ITS INTERNAL SERVICE NAME
+# (drasl:25585, nmsr:8080, minecraft:25565) without leaving the host — and can
+# also hit the public https vhosts end-to-end through the host's DNS.
+#
+# Caddy reverse-proxies status.${BASE_DOMAIN} -> uptime-kuma:3001 internally
+# (caddy/conf.d/50-status.caddy). The host port is published on 127.0.0.1:3001
+# ONLY (local debugging / first-run admin setup) — public access goes through
+# nginx -> caddy. Add status.${BASE_DOMAIN} to LE_SUBDOMAINS for its TLS cert.
+#
+# Monitors are stored in the kuma_data volume (Kuma has no config-as-code);
+# add them once via the web UI — see README for the recommended monitor list.
+services:
+  caddy:
+    volumes:
+      - ./caddy/conf.d/50-status.caddy:/etc/caddy/conf.d/50-status.caddy:ro
+
+  uptime-kuma:
+    image: louislam/uptime-kuma:1
+    container_name: uptime-kuma
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:3001:3001"
+    volumes:
+      - kuma_data:/app/data
+    networks:
+      - mcnet
+
+volumes:
+  kuma_data: