Fix functional bugs found in service audit

wg-easy: PASSWORD env var removed in v14+; generate bcrypt hash at install
  time via 'docker run wg-easy wgpw' and write PASSWORD_HASH instead.

ntfy: write config/server.yml with base-url, cache-file, auth-file, and
  behind-proxy:true so push notification links work when behind Caddy.
  auth-default-access: deny-all (require topic auth).

mealie: BASE_URL was hardcoded to http://localhost:9925; email links and
  OAuth redirects broke when served via Caddy. Now computed from SITE_DOMAIN
  and written to .env so it's easy to update.

nextcloud: add OVERWRITEPROTOCOL=https, OVERWRITECLIURL, TRUSTED_PROXIES to
  .env so share links and internal redirects use https:// behind Caddy.

onlyoffice: Caddy's default X-Frame-Options: SAMEORIGIN header blocked
  OnlyOffice from being embedded as an iframe in Nextcloud. Override it in
  the Caddy site block to allow framing.

vaultwarden: remove exposed port 3012 (WebSocket — not needed since v1.29+,
  all handled on port 80). Publish port 8888 for direct host access instead.
  Remove WEBSOCKET_ENABLED=true (ignored in current versions).

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

services/vaultwarden.sh

@@ -220,10 +220,8 @@ services:
     env_file: .env
     volumes:
       - ./vaultwarden_data:/data
-    expose:
-      - "80"
     ports:
-      - "3012:3012"    # WebSocket (legacy — not needed for Vaultwarden v1.29+)
+      - "8888:80"
     networks:
       - caddy_net
 
@@ -250,8 +248,6 @@ ADMIN_TOKEN=$ADMIN_TOKEN
 SIGNUPS_ALLOWED=false
 SIGNUPS_VERIFY=false
 
-# WebSocket notifications (v1.29+: built into port 80, no separate port needed)
-WEBSOCKET_ENABLED=true
 
 # ── SMTP (optional — for password-reset and invite emails) ────────────────────
 SMTP_HOST=$SMTP_HOST