feat(gateway): deploy Cloudflare DDNS daemon, wildcard SSL cert, and Caddy HTTPS reverse proxy on 10443

CHANGELOG.md

@@ -82,5 +82,21 @@
   - 恢复 ShellCrash 配置：`cat ~/homelab/backups/router/config.yaml.bak | ssh 192.168.31.1 "cat > /userdisk/ShellCrash/yamls/config.yaml && /userdisk/ShellCrash/start.sh bfstart"`
   - 删除端口转发：`ssh 192.168.31.1 "uci delete firewall.@redirect[-1] && uci commit firewall && /etc/init.d/firewall reload"`
 
+### 9. 配置 Cloudflare DDNS 自动守护进程、`*.home.961504.xyz` 泛域名 SSL 证书与 HTTPS 反代网关
+- **操作时间**：2026-11-06 21:56 ~ 21:58
+- **目标设备**：Mac mini (`192.168.31.164`) & Cloudflare (`961504.xyz`) & 小米路由器 (`192.168.31.1`)
+- **变更内容**：
+  1. **Cloudflare DDNS**：编写 [`scripts/cloudflare-ddns.sh`](file:///Users/ixvii0iv/homelab/scripts/cloudflare-ddns.sh) 并在 Mac mini 注册 `~/Library/LaunchAgents/com.homelab.cf-ddns.plist`（每 5 分钟自动运行），已将 `home.961504.xyz` 与 `*.home.961504.xyz` 解析至当前联通公网 IP `124.90.142.21`。
+  2. **泛域名 HTTPS 证书 (`acme.sh`)**：通过 Cloudflare DNS-01 验证自动签发 `home.961504.xyz` + `*.home.961504.xyz` ECC 泛域名证书，存放于 `~/homelab/stacks/gateway/certs/`。
+  3. **明文 HTTPS 反代网关 (`home-gateway`)**：部署 [`stacks/gateway/docker-compose.yml`](file:///Users/ixvii0iv/homelab/stacks/gateway/docker-compose.yml) 与 [`stacks/gateway/Caddyfile`](file:///Users/ixvii0iv/homelab/stacks/gateway/Caddyfile)，监听 `10443` 端口提供：
+     - `https://nas.home.961504.xyz:10443` (`z4.home.961504.xyz:10443`) -> 极空间 Z4 (`192.168.31.185:5055`)
+     - `https://lucky.home.961504.xyz:10443` -> Lucky (`16601`)
+     - `https://clash.home.961504.xyz:10443` -> 路由器 Mihomo 面板 (`192.168.31.1:9999`)
+  4. **路由器直连优化**：在 [`configs/router-shellcrash-config.yaml`](file:///Users/ixvii0iv/homelab/configs/router-shellcrash-config.yaml) 中新增 `DOMAIN-SUFFIX,home.961504.xyz,全球直连`，避免内网访问家庭域名时绕行境外代理。
+- **回滚方式**：
+  - 停止 DDNS：`ssh mini "launchctl unload ~/Library/LaunchAgents/com.homelab.cf-ddns.plist"`
+  - 停止反代网关：`ssh mini "cd ~/homelab/stacks/gateway && docker compose down"`
+
+