Move HAProxy into the host network namespace so it sees the real
client source IP on inbound connections.  With bridge networking +
published ports the source IP is rewritten to the bridge gateway by
the runtime (Docker's userland-proxy, rootless Podman's slirp4netns
or pasta), and the PROXY v2 header HAProxy then sends to mtg and
Caddy carries that useless address.

mtg and Caddy stay on the compose bridge and publish their ports on
host loopback; the host-mode HAProxy dials them at 127.0.0.1.  Caddy's
proxy_protocol allow list is tightened to loopback only.

The 'sysctls: net.ipv4.ip_unprivileged_port_start=80' line is removed
because Docker refuses to apply namespaced sysctls when the netns is
shared with the host.  Rootless Podman users binding the privileged
ports need the equivalent host-side sysctl once; this is documented
in README.md.

Fixes #498.

Lets downstreams add per-service env vars (e.g. HOST for Caddy's
Dynu DNS-01 challenge) without breaking the shared DOMAIN alias.

Closes #501.

Before: the SNI hostname had to be edited in haproxy.cfg, plus
DOMAIN had to be set in .env for Caddy.  Two places to keep in sync.

After: DOMAIN is the single source — set it once in .env (or export),
docker-compose forwards it into both haproxy and caddy containers,
and HAProxy interpolates ${DOMAIN} into the SNI ACL at startup.

mtg-config.toml's secret still embeds the domain in its bytes
(generated once with `mtg generate-secret <domain>`), so that one
remains a one-time edit at install — the README is updated to reflect
this.

HAProxy has supported environment-variable substitution in config
strings since 1.6.

Might be needed for local chained proxy setup.

Fix SELinux-related permission denied error for containerized apps
reading configs exposed via volumes.
Also make it possible to use port 80 in the fronted.

Add an ACL that routes /.well-known/acme-challenge/ requests on :80
to Caddy instead of redirecting to HTTPS, so Let's Encrypt certificate
issuance works out of the box.

Also simplify Caddyfile to use Caddy's http_port/https_port directives.

Turnkey deployment: HAProxy on :443 peeks at the TLS SNI and routes
Telegram clients to mtg while forwarding everything else (including DPI
probes) to a real Caddy web server with automatic HTTPS.

This is the setup recommended in BEST_PRACTICES.md, packaged so that
operators can clone and run it with minimal configuration.

Refs: #458