refactor: switch nginx to Caddy with automatic Let's Encrypt

Nginx required manually managed certs on port 8443; TLS was effectively
unused. Caddy issues and renews certificates for DOMAIN on its own.

- Caddyfile replaces nginx.conf + locations.conf; upstreams are one
  `import api <prefix> <host> <path-prefix>` line each
- routes wrapped in `route {}` so guards run before handle_path
- access control (IP allowlist, X-Proxy-Token) generated from env into
  matchers.caddy / guard.caddy by the entrypoint, as before
- listeners: 443 (+udp, HTTP/3) and 80 for ACME on DOMAIN, plus the
  unchanged plain-HTTP 8082 -> 8080 path for existing clients
- caddy_data volume added: losing it re-issues certs and burns LE limits
- scripts/migrate-host-nginx.sh backs up and retires the host nginx
- deploy.sh points at the real prod layout (/srv/elevenlabs, compose v1)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/deploy.sh

@@ -1,25 +1,26 @@
 #!/usr/bin/env bash
-# proxy-vm/scripts/deploy.sh
-# Pull latest changes and redeploy containers.
+# elevenlabs.io/scripts/deploy.sh
+# Pull the latest image built by Gitea Actions and restart the proxy.
 set -euo pipefail
 
-PROXY_DIR="/opt/proxy/proxy-vm"
+PROXY_DIR="${PROXY_DIR:-/srv/elevenlabs}"
 cd "${PROXY_DIR}"
 
-echo "=== [1/5] Pulling latest code ==="
-git -C "$(dirname "${PROXY_DIR}")" pull
+COMPOSE="docker-compose"
+command -v docker-compose >/dev/null 2>&1 || COMPOSE="docker compose"
 
-echo "=== [2/5] Building container ==="
-docker compose build --no-cache
+echo "=== [1/4] Pulling latest image ==="
+${COMPOSE} pull
 
-echo "=== [3/5] Restarting containers ==="
-docker compose up -d --force-recreate
+echo "=== [2/4] Recreating container ==="
+${COMPOSE} up -d
 
-echo "=== [4/5] Container status ==="
-docker compose ps
+echo "=== [3/4] Status ==="
+${COMPOSE} ps
 
-echo "=== [5/5] Recent logs ==="
-docker compose logs --tail=20 proxy
+echo "=== [4/4] Recent logs ==="
+${COMPOSE} logs --tail=30 proxy
 
 echo ""
-echo "Deploy complete."
+echo "Health: curl -s http://localhost:8082/health"
+echo "TLS:    curl -s https://${DOMAIN:-proxy.bildme.ru}/health"