Add the example stack payloads

The files copied to /srv/stacks/<stack>/ verbatim: compose files, vhosts,
Prometheus configuration, the webapp image source. Payloads are data, never
templated and never linted as Ansible content.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

server/edge/reverse-proxy/proxy-data/vhost/app.example.com

@@ -0,0 +1,23 @@
+# Per-vhost nginx configuration for app.example.com, included by nginx-proxy.
+#
+# A container that sets VIRTUAL_HOST gets its vhost generated automatically and
+# needs nothing here. This file is for the cases generation cannot express:
+# routes to a service that is not the vhost's main container, and access rules.
+
+# Anything not otherwise routed goes to the public site.
+location = / {
+    return 301 https://app.example.com/tools/;
+}
+
+# Internal-only: the metrics stack, reachable from the private network and
+# nowhere else. Keep the deny rule directly beneath the allow rule — nginx takes
+# the first match, so an allow added below a `deny all` does nothing.
+location ^~ /internal/metrics/ {
+    allow 10.0.0.0/8;
+    deny all;
+
+    proxy_pass http://prometheus:9090/internal/metrics/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+}