feat(portal): move edge proxy services from Jeeves

- move HAProxy and ACME certificate management to Portal
- route application backends to Jeeves over Tailscale
- restrict Jeeves backend ports to the Tailscale interface
- expose Gems for remote proxy access

systems/jeeves/services/gitea.nix

@@ -3,7 +3,6 @@ let
 in
 {
   networking.firewall.allowedTCPPorts = [
-    6443
     2223
   ];