Run an always-on Syncthing peer on the droplet as an off-site copy for the
owner's folders. New syncthing/ compose stack on proxy_net: the sync protocol
is published on host 22000 (tcp+udp) for direct device connections, while the
GUI (8384) is unpublished and reached only through the central Caddy, which
gains a sync.waldson.com.br reverse-proxy block. Config and folder data live on
a host bind mount for SSH inspection and are git-ignored. README documents the
deploy, upgrade, and interactive pairing runbook.
Binding the GUI to a non-loopback address (STGUIADDRESS) also disables
Syncthing's DNS-rebinding host check, so the proxy needs no Host rewrite.
