feat(cloud): harden nginx-proxy + sql foundation; HTTP-01 interim cert plan

Wire up the three foundation stacks (nginx-proxy, sql, portainer) in
cloud/compose.yml and add real configs for the first two.

nginx-proxy
- Base nginx.conf with http + stream contexts, modern TLS profile,
  client_max_body_size baseline for gitea LFS / mlflow artifacts.
- Vhosts under conf.d/: grafana, gitea, keycloak, nodered, mlflow,
  jupyter, portainer (HTTPS upstream), rabbitmq, jenkins. WebSocket
  upgrade headers where needed (grafana live, node-red editor,
  jupyterhub kernels, jenkins agents).
- conf.d/00-default.conf serves /.well-known/acme-challenge/ on :80
  and 301-redirects everything else.
- stream.d/mqtt.conf terminates MQTT-TLS at 8883, proxies to
  rabbitmq:1883 internally.
- All vhosts reference /etc/letsencrypt/live/infra/* — a stable path
  via certbot --cert-name infra, so the wildcard migration changes
  nothing in the vhost files.
- README documents: HTTP-01 SAN interim during Versio period →
  DNS-01 wildcard via certbot-dns-transip after migration; bootstrap
  procedure (self-signed fallback → real cert issuance → reload).

sql
- config/init.d/01-databases.sh provisions gitea/keycloak/mlflow
  databases + roles on first start. Idempotent only via fresh
  data volume — change the script after first run requires
  manual psql or a volume wipe.
- compose env extended with GITEA_DB_PASSWORD, KEYCLOAK_DB_PASSWORD,
  MLFLOW_DB_PASSWORD.

cloud
- include: now wires nginx-proxy + sql + portainer. Other stacks
  stay commented for future rounds.
- .env.example adds KEYCLOAK_DB_PASSWORD and sensible defaults
  (LETSENCRYPT_EMAIL, GRAFANA_ROOT_URL, KEYCLOAK_HOSTNAME,
  GITEA_ROOT_URL, POSTFIX_FROM_DOMAIN all pointing at wbd-rd.nl).
- Operator note inline: bring portainer's standalone instance down
  before deploying via cloud compose; comment its ports: block.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloud/compose.yml

@@ -6,13 +6,14 @@ name: cloud
 
 # Uncomment includes as each stack is hardened beyond stub.
 include:
-  # Core ingress + identity
-  # - ../stacks/nginx-proxy/compose.yml
+  # Foundation (round 3) — ingress, auth backing store, ops console
+  - ../stacks/nginx-proxy/compose.yml
+  - ../stacks/sql/compose.yml
+  - ../stacks/portainer/compose.yml
+  # Core identity + VPN
   # - ../stacks/wireguard-server/compose.yml
   # - ../stacks/keycloak/compose.yml
-  # - ../stacks/portainer/compose.yml
   # Data
-  # - ../stacks/sql/compose.yml
   # - ../stacks/influxdb/compose.yml
   # Apps
   # - ../stacks/node-red/compose.yml
@@ -28,6 +29,13 @@ include:
   # FROST (when deployed)
   # - ../stacks/mosquitto/compose.yml
 
+# NOTE on portainer transition:
+#   The portainer stack publishes 9443+8000 for standalone first-run use.
+#   When bringing it up through this cloud compose, take the standalone
+#   instance down first (`cd stacks/portainer && docker compose down`) and
+#   comment out the `ports:` block in stacks/portainer/compose.yml so
+#   nginx-proxy is the only ingress. Access then via https://portainer.wbd-rd.nl/.
+
 networks:
   edge:
     name: cloud-edge
@@ -38,7 +46,7 @@ networks:
   data:
     name: cloud-data
     driver: bridge
-    internal: true      # databases — no internet egress
+    internal: true       # databases — no internet egress
   mgmt:
     name: cloud-mgmt
     driver: bridge