acme_forward: send services' ACME challenges to Traefik on ops

The XMPP certificate covers xmpp.asxp.io and conference.asxp.io, which
point at asxpio-services, so Let's Encrypt validates them there. A small
nginx on port 80 passes /.well-known/acme-challenge/ over the VPC to
Traefik, which holds all certificates, and answers 404 to the rest.

Assisted-by: Claude:opus-5-5

ansible/roles/acme_forward/tasks/main.yaml

@@ -0,0 +1,14 @@
+---
+# Port 80 on asxpio-services exists only for Let's Encrypt: HTTP challenges
+# for names pointing here (xmpp., conference.) go to Traefik on ops, which
+# holds the certificates. Anything else gets a 404.
+- name: Deploy the ACME challenge forwarder
+  ansible.builtin.include_role:
+    name: docker_service
+  vars:
+    service_name: acme-forward
+    service_base_path: "{{ services_base_path }}/acme-forward"
+    service_templates:
+      - { src: docker-compose.yml.j2, dest: docker-compose.yml }
+      - { src: nginx.conf.j2, dest: nginx.conf }
+    health_check_port: 80