feat: add nginx reverse proxy stack

Add Nginx and acme.sh for centralized HTTPS termination and certificate management.

Move Gitea, Immich, and OpenList to the shared proxy network and remove their direct host port exposure.

nginx/compose.yaml

@@ -0,0 +1,47 @@
+name: nginx
+services:
+  nginx:
+    image: nginx:1-alpine
+    container_name: nginx
+    volumes:
+      - /srv/data/nginx/conf.d:/etc/nginx/conf.d:ro
+      - /srv/data/nginx/snippets:/etc/nginx/snippets:ro
+      - /srv/data/nginx/certs:/etc/nginx/certs:ro
+    ports:
+      - "192.168.10.101:80:80"
+      - "192.168.10.101:443:443"
+      - "[::]:50443:443"
+    networks:
+      - proxy
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 256M
+        reservations:
+          cpus: "0.05"
+          memory: 16M
+  acme-sh:
+    image: neilpang/acme.sh:3.1.4
+    container_name: acme.sh
+    volumes:
+      - /srv/data/nginx/acme-sh:/acme.sh
+      - /srv/data/nginx/certs:/certs
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      CF_Token: ${CF_TOKEN}
+      CF_Zone_ID: ${CF_ZONE_ID}
+    command: daemon
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "0.2"
+          memory: 64M
+        reservations:
+          cpus: "0.05"
+          memory: 16M
+networks:
+  proxy:
+    external: true