Fix functional bugs found in service audit

wg-easy: PASSWORD env var removed in v14+; generate bcrypt hash at install
  time via 'docker run wg-easy wgpw' and write PASSWORD_HASH instead.

ntfy: write config/server.yml with base-url, cache-file, auth-file, and
  behind-proxy:true so push notification links work when behind Caddy.
  auth-default-access: deny-all (require topic auth).

mealie: BASE_URL was hardcoded to http://localhost:9925; email links and
  OAuth redirects broke when served via Caddy. Now computed from SITE_DOMAIN
  and written to .env so it's easy to update.

nextcloud: add OVERWRITEPROTOCOL=https, OVERWRITECLIURL, TRUSTED_PROXIES to
  .env so share links and internal redirects use https:// behind Caddy.

onlyoffice: Caddy's default X-Frame-Options: SAMEORIGIN header blocked
  OnlyOffice from being embedded as an iframe in Nextcloud. Override it in
  the Caddy site block to allow framing.

vaultwarden: remove exposed port 3012 (WebSocket — not needed since v1.29+,
  all handled on port 80). Publish port 8888 for direct host access instead.
  Remove WEBSOCKET_ENABLED=true (ignored in current versions).

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

services/onlyoffice.sh

@@ -299,7 +299,13 @@ OO_ENV
     chmod 600 .env
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$DIR"
 
-    configure_caddy_for_service "OnlyOffice" "onlyoffice:80" "office"
+    # OnlyOffice must be embeddable as an iframe in Nextcloud/FileBrowser.
+    # Override X-Frame-Options to allow same-site embedding (remove SAMEORIGIN restriction).
+    local OO_EXTRA_BLOCK='    header {
+        -X-Frame-Options
+        Content-Security-Policy "frame-ancestors '\''self'\'' *"
+    }'
+    configure_caddy_for_service "OnlyOffice" "onlyoffice:80" "office" "$OO_EXTRA_BLOCK"
 
     local START=""
     prompt_yn "Start OnlyOffice now? (y/n):" "y" START