feat(status): Uptime Kuma monitoring at status.${BASE_DOMAIN}

Add docker-compose.status.yml (louislam/uptime-kuma) layered on the caddy
ingress, joining mcnet so it probes the stack by internal service name and
the public vhosts end-to-end. Host port bound to 127.0.0.1:3001 only; public
access via nginx -> caddy.

- caddy/conf.d/50-status.caddy: status. -> uptime-kuma:3001
- nginx caddy-front template: status. TLS vhost + websocket upgrade headers
  for Kuma's live UI; status. added to the HTTP->HTTPS redirect list
- status added to LE_SUBDOMAINS defaults (.env.example, issue-letsencrypt.sh)
- README: Status monitoring section + recommended monitor list (incl. native
  Minecraft-protocol ping)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tooling/issue-letsencrypt.sh

@@ -17,7 +17,7 @@
 #   OVH_CK            OVH consumer key (obtained on first run — see below)
 #   OVH_END_POINT     OVH API endpoint (e.g. ovh-eu)
 # optional:
-#   LE_SUBDOMAINS     space-separated (default: "auth pack distribution www avatar")
+#   LE_SUBDOMAINS     space-separated (default: "auth pack distribution www avatar status")
 #   LE_STAGING=1      use the LE staging CA (untrusted, for dry runs)
 #
 # First-time OVH consumer key: set OVH_AK/OVH_AS/OVH_END_POINT, leave OVH_CK
@@ -53,7 +53,7 @@ ACME="${ACME_SH:-$HOME/.acme.sh/acme.sh}"
 then re-run (or set ACME_SH=/path/to/acme.sh)."
 
 CERT_DIR="${CERT_DIR:-certs}"
-read -r -a SUBDOMAINS <<< "${LE_SUBDOMAINS:-auth pack distribution www avatar}"
+read -r -a SUBDOMAINS <<< "${LE_SUBDOMAINS:-auth pack distribution www avatar status}"
 
 if [ "${LE_STAGING:-0}" = "1" ]; then
   SERVER="letsencrypt_test"; warn "STAGING mode — certs will NOT be trusted by browsers"