feat: proxy admin panel via nginx port 80 to avoid exposing 8444

Route the panel through a secret subpath on port 80, remove the separate
8444 listener, and document common troubleshooting in docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/nginx/acme.conf.template

@@ -14,4 +14,16 @@ server {
         return 200 'ok';
         add_header Content-Type text/plain;
     }
+
+    # 管理面板（Nginx 反向代理至 Flask，无需额外暴露 8444）
+    location ^~ __PANEL_LOCATION__ {
+__PANEL_ALLOW__
+        proxy_pass http://127.0.0.1:5080/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Prefix __PANEL_PREFIX__;
+    }
 }