servers/shadow: open GitLab SSH port, add docker-dev/czechultimate nginx routes

Forward tcp/33022 (FORWARD, LIBVIRT_INP/OUT, PREROUTING DNAT to
192.168.123.21) so the GitLab remote is reachable, add nginx vhosts
for docker-dev-22 and czechultimate.cz, and route fuj-management
through the k8s gateway. Also record saint's eno0 interface config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

servers/shadow/nginx/nginx-sites-enabled-default

@@ -388,4 +388,34 @@ server {
 	listen 80 ;
     server_name fuj-management.home.hrajfrisbee.cz;
     return 404; # managed by Certbot
+}
+
+server {
+    server_name czechultimate.cz;
+
+    # let certbot http-01 land
+    location /.well-known/acme-challenge/ { root /var/www/html; }
+
+    location / { return 301 https://www.czechultimate.cz$request_uri; }
+
+    listen 8443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/czechultimate.cz/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/czechultimate.cz/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+
+server {
+    if ($host = czechultimate.cz) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name czechultimate.cz;
+    return 404; # managed by Certbot
+
+
 }