Add internal reverse proxy for gateways (Caddy, wildcard via DNS-01)

cnx.router.proxy serves <service>.<site><n>.cnx.network with a real Let's
Encrypt wildcard obtained via a gateway-scoped TSIG key against ns1; Blocky
resolves the names to the router's LAN address, so they exist only
internally. First user: Omada UI on gw-cnx-1 (omada.cnx1.cnx.network).

machines/gw-cnx-1/configuration.nix

@@ -6,6 +6,7 @@
   imports = [
     ../../modules/router
     ../../modules/monitoring/exporters.nix
+    (import ../../modules/dns/acme-gw-secret.nix "gw-cnx-1")
   ];
 
   clan.core.sops.defaultGroups = [ "admins" ];
@@ -36,6 +37,17 @@
     };
     # This site runs the Omada controller for its APs/switches.
     omada.enable = true;
+
+    # Internal reverse proxy: real wildcard cert *.cnx1.cnx.network; Blocky
+    # resolves the names to the router's LAN address for mgmt+lan clients.
+    proxy = {
+      enable = true;
+      services.omada = {
+        # Omada's UI is HTTPS with a self-signed cert on the host network.
+        backend = "https://127.0.0.1:8043";
+        insecureSkipVerify = true;
+      };
+    };
   };
 
   time.timeZone = "Etc/GMT-7"; # UTC+7 (Thailand, fixed offset, no DST)