servers/shadow: open GitLab SSH port, add docker-dev/czechultimate nginx routes

Forward tcp/33022 (FORWARD, LIBVIRT_INP/OUT, PREROUTING DNAT to
192.168.123.21) so the GitLab remote is reachable, add nginx vhosts
for docker-dev-22 and czechultimate.cz, and route fuj-management
through the k8s gateway. Also record saint's eno0 interface config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

servers/shadow/nginx/22_docker-dev_hrajfrisbee.cz.conf

@@ -0,0 +1,35 @@
+# ----------------
+# api-sync-dev.psmf.hrajfrisbee.cz
+server {
+  client_max_body_size 15m;                                                                                                                                                              proxy_read_timeout 600;
+  server_name
+        api-sync-dev.psmf.hrajfrisbee.cz
+        ;
+  location / {
+    proxy_pass http://192.168.123.22:8003;
+  }
+
+    listen 8443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/api-sync-dev.psmf.hrajfrisbee.cz/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/api-sync-dev.psmf.hrajfrisbee.cz/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+
+
+server {
+    if ($host = api-sync-dev.psmf.hrajfrisbee.cz) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+  listen 80;
+  server_name
+        api-sync-dev.psmf.hrajfrisbee.cz
+        ;
+    return 404; # managed by Certbot
+
+
+}