refactor: switch nginx to Caddy with automatic Let's Encrypt

Nginx required manually managed certs on port 8443; TLS was effectively
unused. Caddy issues and renews certificates for DOMAIN on its own.

- Caddyfile replaces nginx.conf + locations.conf; upstreams are one
  `import api <prefix> <host> <path-prefix>` line each
- routes wrapped in `route {}` so guards run before handle_path
- access control (IP allowlist, X-Proxy-Token) generated from env into
  matchers.caddy / guard.caddy by the entrypoint, as before
- listeners: 443 (+udp, HTTP/3) and 80 for ACME on DOMAIN, plus the
  unchanged plain-HTTP 8082 -> 8080 path for existing clients
- caddy_data volume added: losing it re-issues certs and burns LE limits
- scripts/migrate-host-nginx.sh backs up and retires the host nginx
- deploy.sh points at the real prod layout (/srv/elevenlabs, compose v1)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/migrate-host-nginx.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# elevenlabs.io/scripts/migrate-host-nginx.sh
+# Frees ports 80/443 on the host so the Caddy container can obtain Let's Encrypt certs.
+# Backs up the whole host nginx configuration first, then stops and disables the service.
+set -euo pipefail
+
+BACKUP_DIR="/root/nginx-backup-$(date +%Y%m%d-%H%M%S)"
+
+if ! systemctl is-active --quiet nginx; then
+    echo "Host nginx is not running — nothing to migrate."
+    exit 0
+fi
+
+echo "=== [1/5] Dumping host nginx config to ${BACKUP_DIR} ==="
+mkdir -p "${BACKUP_DIR}"
+nginx -T > "${BACKUP_DIR}/nginx-T.dump" 2>&1 || true
+tar -czf "${BACKUP_DIR}/etc-nginx.tar.gz" /etc/nginx 2>/dev/null
+cp -a /etc/letsencrypt "${BACKUP_DIR}/letsencrypt" 2>/dev/null || true
+echo "Backup written."
+
+echo "=== [2/5] Virtual hosts currently served ==="
+grep -hE '^\s*server_name' "${BACKUP_DIR}/nginx-T.dump" | sed 's/^[ \t]*//' | sort -u
+
+read -r -p "Stop and disable host nginx? These vhosts will go offline [y/N] " answer
+case "${answer}" in
+    [yY]) ;;
+    *) echo "Aborted. Backup kept at ${BACKUP_DIR}"; exit 1 ;;
+esac
+
+echo "=== [3/5] Stopping nginx ==="
+systemctl disable --now nginx
+
+echo "=== [4/5] Certbot renewal hooks ==="
+# Certbot keeps trying to renew certs through the nginx plugin — it would fail now.
+systemctl disable --now certbot.timer 2>/dev/null || true
+echo "certbot.timer disabled (Caddy manages its own certificates)."
+
+echo "=== [5/5] Port check ==="
+ss -tlnp | grep -E ':(80|443)\s' && { echo "Ports 80/443 are still busy — inspect before starting Caddy."; exit 1; }
+echo "Ports 80 and 443 are free."
+echo ""
+echo "Backup: ${BACKUP_DIR}"
+echo "Next: cd /srv/elevenlabs && docker-compose pull && docker-compose up -d"