feat(portal): proxy Gitea SSH through HAProxy

- expose Gitea SSH through Portal on port 2223
- advertise the correct Gitea SSH user and domain
- add the Gitea host to Richie’s SSH config
- correct the local ACME challenge backend port

systems/portal-1/haproxy/default.nix

@@ -35,6 +35,7 @@ in
   networking.firewall.allowedTCPPorts = [
     80
     443
+    2223
   ];
 
   # Global robots.txt served by HAProxy for every vhost (see haproxy.cfg).

systems/portal-1/haproxy/haproxy.cfg

@@ -110,6 +110,14 @@ frontend ContentSwitching
   use_backend gems  if host_gems
   use_backend norn_sight  if host_norn_sight
 
+# Proxy Gitea's built-in SSH server over Tailscale to Jeeves. Port 22 remains
+# available to Endlessh on Portal.
+frontend GiteaSSH
+  bind *:2223 v4v6
+  mode tcp
+  option tcplog
+  default_backend gitea_ssh
+
 # Stick-table only (no servers): tracks per-IP request rate to Gitea's compare
 # endpoint over a 5-minute window so the frontend can cap it at 1 per 5 min.
 backend st_compare
@@ -120,7 +128,7 @@ backend st_gems_join
 
 backend acme_challenge
   mode http
-  server acme 127.0.0.1:8080
+  server acme 127.0.0.1:8402
 
 backend audiobookshelf_nodes
   mode http
@@ -143,6 +151,10 @@ backend gitea
   mode http
   server server jeeves:6443
 
+backend gitea_ssh
+  mode tcp
+  server gitea jeeves:2223
+
 backend gems
   mode http
   option forwardfor