fix(gateway): run Caddy as macOS System LaunchDaemon for pre-login start and LAN TCC bypass

stacks/gateway/Caddyfile

@@ -1,6 +1,8 @@
 # ==============================================================================
 # 家庭公网 HTTPS 统一反向代理网关 (Mac mini: 10443 端口)
-# 证书：/certs/fullchain.pem & /certs/privkey.pem (由 acme.sh 自动续签 *.home.961504.xyz)
+# 运行方式：macOS System LaunchDaemon (sudo brew services start caddy)
+# 配置文件路径：/opt/homebrew/etc/Caddyfile (与本文件同步)
+# 证书：/Users/ixvii0iv/homelab/stacks/gateway/certs/ (由 acme.sh 自动续签 *.home.961504.xyz)
 # ==============================================================================
 {
     auto_https disable_redirects
@@ -8,21 +10,21 @@
 
 # 1. 极空间 Z4 NAS (https://z4.home.961504.xyz:10443 或 https://nas.home.961504.xyz:10443)
 nas.home.961504.xyz:10443, z4.home.961504.xyz:10443 {
-    tls /certs/fullchain.pem /certs/privkey.pem
+    tls /Users/ixvii0iv/homelab/stacks/gateway/certs/fullchain.pem /Users/ixvii0iv/homelab/stacks/gateway/certs/privkey.pem
     encode zstd gzip
     reverse_proxy 192.168.31.185:5055
 }
 
 # 2. Lucky 控制台 (https://lucky.home.961504.xyz:10443)
 lucky.home.961504.xyz:10443 {
-    tls /certs/fullchain.pem /certs/privkey.pem
+    tls /Users/ixvii0iv/homelab/stacks/gateway/certs/fullchain.pem /Users/ixvii0iv/homelab/stacks/gateway/certs/privkey.pem
     encode zstd gzip
-    reverse_proxy host.docker.internal:16601
+    reverse_proxy 127.0.0.1:16601
 }
 
-# 3. 路由器 Mihomo / Clash 面板 (https://clash.home.961504.xyz:10443)
+# 3. 路由器 Mihomo / Clash 面板 (https://clash.home.961504.xyz:10443/ui/)
 clash.home.961504.xyz:10443 {
-    tls /certs/fullchain.pem /certs/privkey.pem
+    tls /Users/ixvii0iv/homelab/stacks/gateway/certs/fullchain.pem /Users/ixvii0iv/homelab/stacks/gateway/certs/privkey.pem
     encode zstd gzip
     reverse_proxy 192.168.31.1:9999
 }