build(train): Train's server and BRouter deployable beside the instance (ADR 0030, D46)

deploy/compose.train.yaml adds Train's server at train.halkyon.eu, a
member of Learn's register, with its database halkyon_train in the
instance's PostgreSQL, and BRouter beside it alone (v1.7.10, checked by
SHA-256, no log), its segments of the operator's region kept current
monthly. Nothing changes until deploy/.env names the compose file:
redeploy.sh and backup.sh take Train in only then, and the operator's
steps are in sidecars/README.md. restic now forgets snapshots grouped by
host alone, so adding Train's dump leaves no group behind for good.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/sidecars/train.caddy

@@ -0,0 +1,10 @@
+# Halkyon Train's site (compose.train.yaml, ADR 0030, D46): its API server alone. Its
+# web server (8082) takes only the register's calls between the instance's services
+# (`/halkyon-base/…`, ADR 0016), on the instance's own network, never through here.
+{$TRAIN_DOMAIN} {
+	encode zstd gzip
+
+	# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
+	# The visitor's address comes last in X-Forwarded-For, as for Learn's server.
+	reverse_proxy train-server:8080
+}