feat: security hardening and HTTPS/SSO infrastructure configs

- Narrow trusted proxies, remove overly broad 10.0.0.0/8
- Fail closed on missing SSH known_hosts in terminal proxy
- Add Navidrome reverse proxy headers for Authelia SSO
- Add Gitea docker-compose definition
- Add Caddy configs for NAS and VPS edge proxies
- Add dnsmasq split-horizon DNS config
- Add security execution plan document

tmp_remote/dnsmasq.conf

@@ -0,0 +1,9 @@
+address=/nas.jimmygan.com/100.78.131.124
+address=/music.jimmygan.com/100.78.131.124
+address=/n8n.jimmygan.com/100.78.131.124
+address=/auth.jimmygan.com/100.78.131.124
+address=/ldap.jimmygan.com/100.78.131.124
+address=/git.jimmygan.com/100.78.131.124
+server=223.5.5.5
+server=119.29.29.29
+no-resolv