feat(meditate,deploy): Meditate beside the instance, and every server's public address from .env

Meditate's deploy step (ADR 0038, step 7; ADR 0039, D14), as Todo's: the
server's Dockerfile with the library's check compiled beside it, its
production config on its own database and role, compose.meditate.yaml as a
member of the register, its site sending /library/* to the web server and
the rest to the API server, the operator's library read-only in a compose
file of its own, and redeploy.sh, backup.sh and the image replay taking it
in.

Every server's public address now comes from .env (Serverpod's
SERVERPOD_API_SERVER_PUBLIC_HOST and _WEB_SERVER_, which win over the
config file): Train, Todo and Meditate from their domains, Learn from
LEARN_PUBLIC_HOST, unset learn.halkyon.eu as before. Without it a server on
halkyon.li would name halkyon.eu in its SimpleLogin callback, profile pages
and privacy page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/sidecars/meditate.caddy

@@ -0,0 +1,20 @@
+# Halkyon Meditate's site (compose.meditate.yaml, ADR 0038, step 7): its API server, and
+# the operator's library's files from its web server (D16), which serves them only with
+# an access its catalogue gave a person signed in. Never the register's calls between
+# the instance's services (`/halkyon-base/…`, ADR 0016), which its web server takes on
+# the instance's own network alone: only /library/* goes there.
+{$MEDITATE_DOMAIN} {
+	encode zstd gzip
+
+	# Recordings and pictures, served by ranges (encode leaves audio and pictures
+	# as they are).
+	handle /library/* {
+		reverse_proxy meditate-server:8082
+	}
+
+	# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
+	# The visitor's address comes last in X-Forwarded-For, as for Learn's server.
+	handle {
+		reverse_proxy meditate-server:8080
+	}
+}