Add rift deployment config for fronting metacrypt containers

Rift-specific config routes metacrypt.svc.mcp.metacircular.net across
three listeners: L7 TLS-terminating to metacrypt-web on :443, L4
passthrough to API on :8443, and L4 passthrough to gRPC on :9443.
Docker compose uses host networking for direct port binding. Includes
self-signed cert generation script for initial L7 deployment. Updates
example config with metrics section and Unix socket for gRPC admin.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/mc-proxy.toml.example

@@ -34,16 +34,9 @@ addr = ":9443"
   backend  = "127.0.0.1:28443"
 
 # gRPC admin API. Optional — omit or leave addr empty to disable.
-# If enabled over TCP, tls_cert and tls_key are required. mTLS (client_ca)
-# is strongly recommended for any non-loopback listen address.
+# Unix socket, secured by file permissions (no TLS needed).
 [grpc]
-addr      = "127.0.0.1:9090"
-tls_cert  = "/srv/mc-proxy/certs/cert.pem"
-tls_key   = "/srv/mc-proxy/certs/key.pem"
-client_ca = "/srv/mc-proxy/certs/ca.pem"    # mTLS; omit to disable client auth
-
-# Unix socket alternative (no TLS needed, secured by file permissions):
-# addr = "/srv/mc-proxy/admin.sock"
+addr = "/srv/mc-proxy/mc-proxy.sock"
 
 # Firewall. Global blocklist, evaluated before routing. Default allow.
 [firewall]
@@ -54,6 +47,11 @@ blocked_countries = ["KP", "CN", "IN", "IL"]
 rate_limit        = 100       # max connections per source IP per window (0 = disabled)
 rate_window       = "1m"      # sliding window duration (required if rate_limit > 0)
 
+# Prometheus metrics. Optional — omit or leave addr empty to disable.
+[metrics]
+addr = "127.0.0.1:9090"
+path = "/metrics"
+
 # Proxy behavior.
 [proxy]
 connect_timeout  = "5s"