refactor: switch nginx to Caddy with automatic Let's Encrypt

Nginx required manually managed certs on port 8443; TLS was effectively
unused. Caddy issues and renews certificates for DOMAIN on its own.

- Caddyfile replaces nginx.conf + locations.conf; upstreams are one
  `import api <prefix> <host> <path-prefix>` line each
- routes wrapped in `route {}` so guards run before handle_path
- access control (IP allowlist, X-Proxy-Token) generated from env into
  matchers.caddy / guard.caddy by the entrypoint, as before
- listeners: 443 (+udp, HTTP/3) and 80 for ACME on DOMAIN, plus the
  unchanged plain-HTTP 8082 -> 8080 path for existing clients
- caddy_data volume added: losing it re-issues certs and burns LE limits
- scripts/migrate-host-nginx.sh backs up and retires the host nginx
- deploy.sh points at the real prod layout (/srv/elevenlabs, compose v1)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -1,21 +1,12 @@
-# proxy-vm/Dockerfile
-FROM nginx:1.27-alpine
+# elevenlabs.io/Dockerfile
+FROM caddy:2.11.4-alpine
 
-# Remove default config
-RUN rm -f /etc/nginx/conf.d/default.conf
-
-# Copy nginx configs
-COPY nginx/nginx.conf /etc/nginx/nginx.conf
-COPY nginx/locations.conf /etc/nginx/locations.conf
-
-# Copy entrypoint script
+COPY Caddyfile /etc/caddy/Caddyfile
 COPY docker-entrypoint.sh /docker-entrypoint.sh
 RUN chmod +x /docker-entrypoint.sh
 
-# Create directories for generated configs and optional SSL certs
-RUN mkdir -p /etc/nginx/conf.d /etc/nginx/ssl
-
-EXPOSE 8080 8443
+# 80/443 — public HTTPS endpoint (ACME + TLS), 8080 — plain HTTP for legacy clients
+EXPOSE 80 443 8080
 
 HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
     CMD wget -qO- http://localhost:8080/health || exit 1