docs(deploy): add install guide for a domain with HTTPS

- docs/install-guide.md: step-by-step server setup (DNS, Docker, install.sh,
  .env, launch, checks), web and Android client setup, own reverse proxy
  variant, updates, backups and troubleshooting
- deploy/compose.tls.yaml + Caddyfile: optional Caddy with automatic
  Let's Encrypt in front of nginx (enabled via COMPOSE_FILE in .env)
- nginx: honour X-Forwarded-Proto/For from private networks
- .env.example: DOMAIN, ACME_EMAIL, COMPOSE_FILE, bootstrap admin vars
- install.sh: create caddy data dirs; release.yml: ship TLS files as assets
- deployment.md, docs index and README link to the guide

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/nginx/default.conf.template

@@ -1,5 +1,11 @@
 # Шаблон обрабатывается envsubst при старте контейнера nginx (переменные: API_UPSTREAM).
-# TLS терминируется здесь или на внешнем прокси — см. docs/deployment.md.
+# HTTPS терминирует внешний прокси: Caddy из compose.tls.yaml или ваш собственный — см. docs/install-guide.md.
+
+# За внешним прокси (Caddy, Traefik, ...) сохраняем исходную схему и IP клиента.
+map $http_x_forwarded_proto $pipu_scheme {
+    default $http_x_forwarded_proto;
+    ''      $scheme;
+}
 
 upstream pipu_api {
     server ${API_UPSTREAM};
@@ -10,6 +16,13 @@ server {
     listen 80;
     server_name _;
 
+    # Доверяем X-Forwarded-For только от частных сетей (docker, LAN), где стоит прокси.
+    set_real_ip_from 10.0.0.0/8;
+    set_real_ip_from 172.16.0.0/12;
+    set_real_ip_from 192.168.0.0/16;
+    real_ip_header X-Forwarded-For;
+    real_ip_recursive on;
+
     root /usr/share/nginx/html;
     client_max_body_size 16m;
 
@@ -23,7 +36,7 @@ server {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $pipu_scheme;
     }
 
     location = /healthz { proxy_pass http://pipu_api; }