Add rift deployment config for fronting metacrypt containers

Rift-specific config routes metacrypt.svc.mcp.metacircular.net across
three listeners: L7 TLS-terminating to metacrypt-web on :443, L4
passthrough to API on :8443, and L4 passthrough to gRPC on :9443.
Docker compose uses host networking for direct port binding. Includes
self-signed cert generation script for initial L7 deployment. Updates
example config with metrics section and Unix socket for gRPC admin.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/docker/docker-compose-rift.yml

@@ -0,0 +1,24 @@
+# mc-proxy on rift — TLS ingress for metacrypt containers.
+#
+# Uses host networking so mc-proxy can bind directly to host ports
+# and reach metacrypt containers on 127.0.0.1:18443/18080/19443.
+#
+# Usage:
+#   docker compose -f deploy/docker/docker-compose-rift.yml up -d
+#
+# Prerequisites:
+#   - /srv/mc-proxy/mc-proxy.toml (copy from deploy/mc-proxy-rift.toml)
+#   - /srv/mc-proxy/certs/ with TLS cert for L7 route
+#   - metacrypt containers running (127.0.0.1:18443, 18080, 19443)
+
+services:
+  mc-proxy:
+    build:
+      context: ../..
+      dockerfile: Dockerfile
+      args:
+        VERSION: "${VERSION:-dev}"
+    network_mode: host
+    volumes:
+      - /srv/mc-proxy:/srv/mc-proxy
+    restart: unless-stopped