Fix functional bugs found in service audit

wg-easy: PASSWORD env var removed in v14+; generate bcrypt hash at install
  time via 'docker run wg-easy wgpw' and write PASSWORD_HASH instead.

ntfy: write config/server.yml with base-url, cache-file, auth-file, and
  behind-proxy:true so push notification links work when behind Caddy.
  auth-default-access: deny-all (require topic auth).

mealie: BASE_URL was hardcoded to http://localhost:9925; email links and
  OAuth redirects broke when served via Caddy. Now computed from SITE_DOMAIN
  and written to .env so it's easy to update.

nextcloud: add OVERWRITEPROTOCOL=https, OVERWRITECLIURL, TRUSTED_PROXIES to
  .env so share links and internal redirects use https:// behind Caddy.

onlyoffice: Caddy's default X-Frame-Options: SAMEORIGIN header blocked
  OnlyOffice from being embedded as an iframe in Nextcloud. Override it in
  the Caddy site block to allow framing.

vaultwarden: remove exposed port 3012 (WebSocket — not needed since v1.29+,
  all handled on port 80). Publish port 8888 for direct host access instead.
  Remove WEBSOCKET_ENABLED=true (ignored in current versions).

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

services/nextcloud.sh

@@ -257,6 +257,12 @@ NEXTCLOUD_ADMIN_USER=admin
 NEXTCLOUD_ADMIN_PASSWORD=$NC_ADMIN_PASS
 NEXTCLOUD_DB_TYPE=mysql
 MYSQL_HOST=db
+
+# ── Reverse proxy trust (required when behind Caddy) ─────────────────────────
+# Without these, share links use http:// and internal redirects may break.
+OVERWRITEPROTOCOL=https
+OVERWRITECLIURL=https://cloud.${SITE_DOMAIN:-example.com}
+TRUSTED_PROXIES=172.16.0.0/12
 NC_ENV
 
     chmod 600 .env