acme_forward: send services' ACME challenges to Traefik on ops

The XMPP certificate covers xmpp.asxp.io and conference.asxp.io, which
point at asxpio-services, so Let's Encrypt validates them there. A small
nginx on port 80 passes /.well-known/acme-challenge/ over the VPC to
Traefik, which holds all certificates, and answers 404 to the rest.

Assisted-by: Claude:opus-5-5

ansible/roles/acme_forward/templates/docker-compose.yml.j2

@@ -0,0 +1,11 @@
+# Managed by Ansible (role acme_forward).
+services:
+  acme-forward:
+    image: nginx:{{ acme_forward_nginx_version }}
+    container_name: acme-forward
+    ports:
+      - "80:80"
+    volumes:
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    restart: unless-stopped
+    mem_limit: 32m

ansible/roles/acme_forward/templates/nginx.conf.j2

@@ -0,0 +1,16 @@
+# Managed by Ansible (role acme_forward).
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_tokens off;
+    access_log off;
+
+    location /.well-known/acme-challenge/ {
+        proxy_pass http://{{ asxpio_ops_vpc_ip }};
+        proxy_set_header Host $host;
+    }
+
+    location / {
+        return 404;
+    }
+}