Add Nginx and acme.sh for centralized HTTPS termination and certificate management. Move Gitea, Immich, and OpenList to the shared proxy network and remove their direct host port exposure.