feat(deploy): halkyon.li's forward through ramiel and its host at home (ADR 0039)

ramiel's HAProxy passes halkyon.li's TLS connections, unopened, through a
WireGuard tunnel to the instance at home, with the visitor's address in a
PROXY header, and everything else to ramiel's own Caddy, moved to the
loopback. Each end's nftables table lets the tunnel carry HAProxy's 443 and
the SSH jump's 22 alone, and nothing from home to ramiel.

The host at home: sshd with keys alone, the root disk unlocked over SSH at
boot (dropbear-initramfs, D20), Docker's and containerd's data bind-mounted
from the HDD, and home's end of the tunnel before Docker. An instance behind
the forward (compose.forwarded.yaml) publishes 443 on the tunnel's address
alone, trusts the PROXY header from ramiel alone, and gets its certificates
through TLS-ALPN, without HTTP/3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/compose.forwarded.yaml

@@ -0,0 +1,18 @@
+# An instance published through another server's HAProxy (ADR 0039, D3, D10 to D12):
+# halkyon.li at home, which ramiel reaches through WireGuard (host/, forward/). Caddy
+# then publishes 443 on the tunnel's address alone, so nothing of the instance answers
+# on the home network, and takes the visitor's address from HAProxy's PROXY header
+# (forwarded.caddy). No 80 (ramiel's Caddy sends plain HTTP on to HTTPS) and no HTTP/3
+# (HAProxy routes TCP alone). Switched on in .env, after the instance's own file:
+#
+#   COMPOSE_FILE=compose.learn.yaml:compose.forwarded.yaml:…
+#
+# The tunnel is the host's (wg-quick@wg-halkyon), started before Docker: host/README.md.
+
+services:
+  caddy:
+    # In place of compose.learn.yaml's 80, 443 and 443/udp, never beside them.
+    ports: !override
+      - "10.61.97.2:443:443"
+    volumes:
+      - ./forwarded.caddy:/etc/caddy/global/forwarded.caddy:ro