feat: add dstack-ingress for custom domain TLS (CPL-152)

[Garandor]

Summary

Adds dstack-ingress service to docker-compose.phala.yml for attestation-bound TLS termination inside the TEE, and wires it into the deploy workflow with per-branch custom domains.

Changes

docker-compose.phala.yml

• Added dstack-ingress service (pinned image with @sha256: digest) for Route 53 DNS-01 TLS
• All required dstack-ingress env vars: DOMAIN, GATEWAY_DOMAIN (_.dstack-base-prod5.phala.network), DNS_PROVIDER, TARGET_ENDPOINT, CERTBOT_EMAIL, SET_CAA
• CERTBOT_EMAIL hardcoded to admin@litprotocol.com (public in ACME registration, not sensitive)
• Route 53 credentials: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY sourced from CERTBOT_-prefixed env vars
• Optional AWS_ROLE_ARN / AWS_REGION documented as comments (not needed with direct IAM permissions)
• cert-data volume for Let's Encrypt certificate persistence
• Comments link to dstack-ingress DNS_PROVIDERS.md for Route 53 reference
• lit-static stays removed (moved to Cloudflare Pages in CPL-33)

.github/workflows/deploy-phala.yml

• Custom domain is mandatory for all branches — no optional stripping logic
• main → api.chipotle.litprotocol.com, next → test.chipotle.litprotocol.com
• base_url and api_root_url derived from domain (no redundant hardcoded URLs)
• Deploy step substitutes CERTBOT_DOMAIN, CERTBOT_AWS_ACCESS_KEY_ID (var), CERTBOT_AWS_SECRET_ACCESS_KEY (secret) into compose file

Required GitHub configuration

• Variable: CERTBOT_AWS_ACCESS_KEY_ID — Route 53 IAM access key
• Secret: CERTBOT_AWS_SECRET_ACCESS_KEY — Route 53 IAM secret key

Dependencies

• CPL-150: Route 53 zone + NS delegation (done)
• CPL-151: IAM credentials + GitHub secrets (required before first deploy)

Test plan

• docker-compose.phala.yml validates with docker compose config
• Merged with next — conflicts resolved cleanly
• CI passes on this PR
• After CPL-151, deploy to next and verify https://test.chipotle.litprotocol.com/health returns 200
• Deploy to main and verify https://api.chipotle.litprotocol.com/health returns 200

🤖 Generated with Claude Code

[linear]

CPL-152 Update docker-compose + deploy workflow for Phase 0

Code changes to deploy dstack-ingress with api.chipotle.litprotocol.com

Builds on PR #153 (feature/cpl-118-add-dstack-ingress-to-docker-composephalayml).

docker-compose.phala.yml

• Change DOMAIN: \"${NODE_DOMAIN}\" → DOMAIN: \"${DOMAIN}\"
• Remove ALIAS_DOMAIN env var (not needed for Phase 0)
• Update header comment: list DOMAIN instead of NODE_DOMAIN, remove ALIAS_DOMAIN

deploy-phala.yml

determine-target — add domain output:

• main: domain=api.chipotle.litprotocol.com
• next: no custom domain

deploy job — sed substitutions:

-e \"s|\\${DOMAIN}|$DOMAIN|g\"
-e \"s|\\${CERTBOT_EMAIL}|$CERTBOT_EMAIL|g\"
-e \"s|\\${AWS_ACCESS_KEY_ID}|$AWS_ACCESS_KEY_ID|g\"
-e \"s|\\${AWS_SECRET_ACCESS_KEY}|$AWS_SECRET_ACCESS_KEY|g\"
-e '/profiles:/d'

Strip profiles: line so dstack-ingress starts unconditionally (phala deploy doesn't support compose profiles).

Blocked on

• CPL-151 (IAM credentials + GitHub secrets)"