refactor: switch nginx to Caddy with automatic Let's Encrypt

Nginx required manually managed certs on port 8443; TLS was effectively
unused. Caddy issues and renews certificates for DOMAIN on its own.

- Caddyfile replaces nginx.conf + locations.conf; upstreams are one
  `import api <prefix> <host> <path-prefix>` line each
- routes wrapped in `route {}` so guards run before handle_path
- access control (IP allowlist, X-Proxy-Token) generated from env into
  matchers.caddy / guard.caddy by the entrypoint, as before
- listeners: 443 (+udp, HTTP/3) and 80 for ACME on DOMAIN, plus the
  unchanged plain-HTTP 8082 -> 8080 path for existing clients
- caddy_data volume added: losing it re-issues certs and burns LE limits
- scripts/migrate-host-nginx.sh backs up and retires the host nginx
- deploy.sh points at the real prod layout (/srv/elevenlabs, compose v1)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/install.sh

@@ -3,7 +3,7 @@
 # Bootstrap script for fresh Ubuntu 24.04 VM.
 set -euo pipefail
 
-PROXY_DIR="/opt/proxy"
+PROXY_DIR="/srv/elevenlabs"
 REPO_URL="https://github.com/YOUR_ORG/YOUR_REPO.git"  # TODO: replace with actual repo
 
 echo "=== [1/6] Installing Docker and dependencies ==="
@@ -25,7 +25,7 @@ else
 fi
 
 echo "=== [5/6] Setting up .env ==="
-cd "${PROXY_DIR}/proxy-vm"
+cd "${PROXY_DIR}"
 if [ ! -f .env ]; then
     cp .env.example .env
     # Generate a random PROXY_SECRET
@@ -33,21 +33,21 @@ if [ ! -f .env ]; then
     sed -i "s/change-me-generate-with-openssl-rand-hex-32/${GENERATED_SECRET}/" .env
     echo ""
     echo ">>> .env created with auto-generated PROXY_SECRET"
-    echo ">>> Edit /opt/proxy/proxy-vm/.env to set ALLOWED_CIDR"
+    echo ">>> Edit ${PROXY_DIR}/.env to set DOMAIN, ACME_EMAIL and ALLOWED_CIDR"
     echo ""
 else
     echo ".env already exists, skipping..."
 fi
 
 echo "=== [6/6] Starting containers ==="
-docker compose up -d --build
+docker-compose up -d
 
 echo ""
 echo "=========================================="
-echo " Proxy is running on port 8080"
-echo " Health check: curl http://localhost:8080/health"
+echo " Proxy is running on ports 80/443 (HTTPS) and 8082 (plain HTTP)"
+echo " Health check: curl http://localhost:8082/health"
 echo ""
-echo " IMPORTANT: Edit ${PROXY_DIR}/proxy-vm/.env"
-echo "   - Set ALLOWED_CIDR to your k8s cluster CIDR"
-echo "   - Then run: docker compose restart"
+echo " IMPORTANT: Edit ${PROXY_DIR}/.env"
+echo "   - Set DOMAIN, ACME_EMAIL and ALLOWED_CIDR"
+echo "   - Then run: docker-compose up -d"
 echo "=========================================="