[002] Add Syncthing stack behind Caddy at sync.waldson.com.br

Run an always-on Syncthing peer on the droplet as an off-site copy for the
owner's folders. New syncthing/ compose stack on proxy_net: the sync protocol
is published on host 22000 (tcp+udp) for direct device connections, while the
GUI (8384) is unpublished and reached only through the central Caddy, which
gains a sync.waldson.com.br reverse-proxy block. Config and folder data live on
a host bind mount for SSH inspection and are git-ignored. README documents the
deploy, upgrade, and interactive pairing runbook.

Binding the GUI to a non-loopback address (STGUIADDRESS) also disables
Syncthing's DNS-rebinding host check, so the proxy needs no Host rewrite.

syncthing/compose.yaml

@@ -0,0 +1,40 @@
+name: syncthing
+
+# Always-on Syncthing peer and off-site copy for the owner's folders. The web
+# GUI is reachable only through the central Caddy proxy on proxy_net (the GUI
+# port is never published); the sync protocol is published directly on host
+# 22000 so devices connect to the droplet without going through relays. See
+# README.md for the deploy, upgrade, and pairing runbook.
+
+services:
+  syncthing:
+    image: syncthing/syncthing:latest
+    restart: unless-stopped
+    hostname: droplet
+    environment:
+      # Own the bind-mounted files as the droplet's deploy user so synced data
+      # is inspectable and manageable over plain SSH.
+      PUID: "1000"
+      PGID: "1000"
+      # Bind the GUI to all interfaces inside the container so Caddy can reach
+      # it over proxy_net. The port is deliberately not published to the host;
+      # Syncthing's own credentials are the only thing guarding this surface.
+      STGUIADDRESS: "0.0.0.0:8384"
+    volumes:
+      # Config (device keys, folder list) and all folder data live here, on a
+      # host bind mount, so everything survives recreation and is visible over
+      # SSH. Git-ignored via the repo's data/ rule.
+      - ./data:/var/syncthing
+    ports:
+      # Sync protocol only. Device IDs authenticate the protocol, so exposing
+      # this publicly is safe by design. No local-discovery port (21027/udp) is
+      # published: it is useless on a public server with no LAN peers.
+      - "22000:22000/tcp"
+      - "22000:22000/udp"
+    mem_limit: 512m
+    networks:
+      - proxy_net
+
+networks:
+  proxy_net:
+    external: true