Merge the ACME module into the HAProxy configuration and start HAProxy only after certificates and Tailscale connectivity are available.
- move HAProxy and ACME certificate management to Portal - route application backends to Jeeves over Tailscale - restrict Jeeves backend ports to the Tailscale interface - expose Gems for remote proxy access