Track cmd/tunneld; scope gitignore to the built binary

The bare 'tunneld' ignore pattern also matched the cmd/tunneld
directory, so the server's main.go was never committed and the
Coolify build failed on COPY cmd. Also update deploy docs for the
Coolify/Traefik topology (API via HTTPS router, tunnel traffic via
TCP SNI passthrough).

README.md

@@ -54,23 +54,32 @@ Every flag also reads an environment variable (`tunneld -h`):
 ## Deploy on Coolify (or any Docker host)
 
 The repo has a multi-stage `Dockerfile` producing a static, non-root
-`alpine` image.
+`alpine` image. Two topologies work; both need DNS for `tunnel.example.com`
+**and** `*.tunnel.example.com` pointing at the host.
 
-1. **Create the app** from this repo (Dockerfile build pack).
-2. **Environment**: set `OPENTUNNEL_DOMAIN` to your domain, e.g.
-   `tunnel.example.com`.
-3. **DNS**: point `tunnel.example.com` and `*.tunnel.example.com` (A/AAAA
-   records) at the host.
-4. **Ports**: map host `443` → container `8443` and host `80` → container
-   `8080`. Do **not** put the app behind Coolify's proxy: visitors' TLS is
-   routed by SNI and terminated by the clients, so a proxy that terminates
-   TLS cannot serve it — `tunneld` itself must own ports 443/80.
-5. **Storage**: add a persistent volume on `/app/data` (the CA, server
-   certificate, and tunnel records live there). A named volume works out of
-   the box; a bind mount must be owned by uid 1000.
+**A. Coolify-managed host (Traefik already owns 443/80).** The API domain is
+served through Traefik (Let's Encrypt); tunnel traffic is passed through
+untouched by SNI, because visitor TLS is terminated by the clients:
+
+- App from this repo, Dockerfile build pack, private repo → deploy key.
+- Domain `https://tunnel.example.com`; `ports_exposes=8080` (Traefik routes
+  HTTPS → the plain-HTTP API port).
+- Env: `OPENTUNNEL_DOMAIN=tunnel.example.com`, `HTTP_MODE=serve` (the API
+  sits behind Traefik; it must not redirect to HTTPS itself).
+- Custom Traefik labels (Coolify stores them base64-encoded):
+  `traefik.tcp.routers.tunnel-data.entrypoints=https`,
+  `...rule=HostSNIRegexp(`^.+\.tunnel\.example\.com$`)`,
+  `...tls.passthrough=true`,
+  `traefik.tcp.services.tunnel-data.loadbalancer.server.port=8443`.
+- Persistent volume on `/app/data`; healthcheck on `/health`.
+
+**B. Plain Docker host.** tunneld owns the public ports itself: map host
+`443` → container `8443` and `80` → container `8080` (`HTTP_MODE=redirect`
+serves `/health` on 80 and 301s the rest), volume on `/app/data`. No
+TLS-terminating proxy may sit in front of the tunnel ports.
 
 Until M2 lands, certificates come from the server's built-in local CA:
-clients need `--ca-cert /app/data/ca.pem` (or `OPENTUNNEL_CA_CERT`), and
+clients need `--ca-cert <data dir>/ca.pem` (or `OPENTUNNEL_CA_CERT`), and
 visitors must trust that CA. With real ACME issuance (M2) everything is
 publicly trusted.