refactor: switch nginx to Caddy with automatic Let's Encrypt

Nginx required manually managed certs on port 8443; TLS was effectively
unused. Caddy issues and renews certificates for DOMAIN on its own.

- Caddyfile replaces nginx.conf + locations.conf; upstreams are one
  `import api <prefix> <host> <path-prefix>` line each
- routes wrapped in `route {}` so guards run before handle_path
- access control (IP allowlist, X-Proxy-Token) generated from env into
  matchers.caddy / guard.caddy by the entrypoint, as before
- listeners: 443 (+udp, HTTP/3) and 80 for ACME on DOMAIN, plus the
  unchanged plain-HTTP 8082 -> 8080 path for existing clients
- caddy_data volume added: losing it re-issues certs and burns LE limits
- scripts/migrate-host-nginx.sh backs up and retires the host nginx
- deploy.sh points at the real prod layout (/srv/elevenlabs, compose v1)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -1,3 +1,9 @@
+# Public domain served over HTTPS (Let's Encrypt certificate is issued for it)
+DOMAIN=proxy.example.com
+
+# Email for the ACME account (expiry notices from Let's Encrypt)
+ACME_EMAIL=
+
 # Secret token — k8s pods must send this in X-Proxy-Token header (optional)
 # If empty or unset — token auth is disabled (open mode, protected by IP allowlist only)
 # Generate with: openssl rand -hex 32