refactor: Cloudflare Tunnel + frp SSH 中转变更

- 新增 cloudflared Docker 服务替代原 Bandwagon frp 方案
- 新增 frpc 转发 Git SSH 到阿里云 VPS
- 为所有服务添加 web entrypoint 路由（兼容 cloudflared HTTP）
- HedgeDoc 添加 X-Forwarded-Proto 中间件修复 CSP 登录问题
- Homepage 添加 xiteng.site 根域名路由
- Gitea 配置 SSH_DOMAIN=git.xiteng.site
- 更新 README 反映当前架构
- .gitignore: frpc.toml / credentials / letsencrypt

cloudflared/compose.yml

@@ -0,0 +1,15 @@
+services:
+  cloudflared:
+    image: cloudflare/cloudflared:latest
+    container_name: cloudflared
+    restart: unless-stopped
+    command: tunnel run
+    volumes:
+      - ./config.yml:/etc/cloudflared/config.yml:ro
+      - ./credentials.json:/etc/cloudflared/credentials.json:ro
+    networks:
+      - homelab_net
+
+networks:
+  homelab_net:
+    external: true

cloudflared/config.yml

@@ -0,0 +1,9 @@
+tunnel: 809bc417-103b-4654-bc81-7cf11fbea964
+credentials-file: /etc/cloudflared/credentials.json
+
+ingress:
+  - hostname: xiteng.site
+    service: http://traefik:80
+  - hostname: "*.xiteng.site"
+    service: http://traefik:80
+  - service: http_status:404