Add rift deployment config for fronting metacrypt containers

Rift-specific config routes metacrypt.svc.mcp.metacircular.net across
three listeners: L7 TLS-terminating to metacrypt-web on :443, L4
passthrough to API on :8443, and L4 passthrough to gRPC on :9443.
Docker compose uses host networking for direct port binding. Includes
self-signed cert generation script for initial L7 deployment. Updates
example config with metrics section and Unix socket for gRPC admin.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/scripts/generate-self-signed.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+set -eu
+
+# Generate a self-signed TLS certificate for mc-proxy L7 routes.
+# Usage: generate-self-signed.sh <hostname> [output-dir]
+#
+# Example:
+#   generate-self-signed.sh metacrypt.svc.mcp.metacircular.net /srv/mc-proxy/certs
+#
+# Produces:
+#   <output-dir>/<sanitized-hostname>.pem  (certificate)
+#   <output-dir>/<sanitized-hostname>.key  (private key)
+
+if [ $# -lt 1 ]; then
+    echo "Usage: $0 <hostname> [output-dir]" >&2
+    exit 1
+fi
+
+HOSTNAME="$1"
+OUTPUT_DIR="${2:-/srv/mc-proxy/certs}"
+DAYS=365
+
+# Sanitize hostname for filename (replace dots with hyphens, drop leading wildcard).
+BASENAME=$(echo "$HOSTNAME" | sed 's/^\*\.//; s/\./-/g')
+CERT="${OUTPUT_DIR}/${BASENAME}.pem"
+KEY="${OUTPUT_DIR}/${BASENAME}.key"
+
+mkdir -p "$OUTPUT_DIR"
+
+openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
+    -nodes -days "$DAYS" \
+    -keyout "$KEY" -out "$CERT" \
+    -subj "/CN=${HOSTNAME}" \
+    -addext "subjectAltName=DNS:${HOSTNAME}"
+
+chmod 600 "$KEY"
+chmod 644 "$CERT"
+
+echo "Generated self-signed certificate (${DAYS} days):"
+echo "  cert: ${CERT}"
+echo "  key:  ${KEY}"
+echo ""
+echo "Verify: openssl x509 -in ${CERT} -noout -text | grep -A1 'Subject Alternative'"