feat(portal): move edge proxy services from Jeeves

- move HAProxy and ACME certificate management to Portal
- route application backends to Jeeves over Tailscale
- restrict Jeeves backend ports to the Tailscale interface
- expose Gems for remote proxy access

common/optional/tailscale.nix

@@ -4,8 +4,6 @@
   ...
 }:
 {
-  networking.firewall.trustedInterfaces = [ "tailscale0" ];
-
   nix.settings = {
     trusted-substituters = [ "http://jeeves:5000" ];
     substituters = [ "http://jeeves:5000/?priority=1&want-mass-query=true" ];