feat: proxy admin panel via nginx port 80 to avoid exposing 8444

Route the panel through a secret subpath on port 80, remove the separate
8444 listener, and document common troubleshooting in docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/nginx/acme.conf.template

@@ -14,4 +14,16 @@ server {
         return 200 'ok';
         add_header Content-Type text/plain;
     }
+
+    # 管理面板（Nginx 反向代理至 Flask，无需额外暴露 8444）
+    location ^~ __PANEL_LOCATION__ {
+__PANEL_ALLOW__
+        proxy_pass http://127.0.0.1:5080/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Prefix __PANEL_PREFIX__;
+    }
 }

server/nginx/panel.conf.template

@@ -1,18 +0,0 @@
-server {
-    listen 8444 ssl;
-    listen [::]:8444 ssl;
-    server_name __DOMAIN__;
-
-    ssl_certificate /etc/sing-box/certs/fullchain.pem;
-    ssl_certificate_key /etc/sing-box/certs/privkey.pem;
-    ssl_protocols TLSv1.2 TLSv1.3;
-
-    location / {
-        proxy_pass http://127.0.0.1:5080;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}