Verify setup.sh works on a fresh VPS

[koinsaari]

Summary

compose/setup.sh was written during the repo restructure but has never been run on a clean host. Until that happens it can't be trusted for disaster recovery.

Context

The current VPS was bootstrapped manually before the script existed. The script is documented as the canonical bootstrap path in README.md, so it needs to actually work cold.

Scope

• Run setup.sh end to end on a fresh VPS (or throwaway VM)
• Validate each step: Docker install, NetBird agent install + up with setup key, UFW rules, proxy-net network creation, /var/log/caddy ownership
• After bootstrap, bring up the Caddy and NetBird stacks and confirm all four public hostnames serve TLS

Acceptance criteria

• Setup completes without manual intervention given a valid NB_SETUP_KEY and a populated .env + netbird/config.yaml
• All public hostnames respond (200/302/307 as appropriate) after a clean bootstrap
• Any rough edges found are fixed in the script before closing this issue

Notes

Hetzner snapshot or a cheap throwaway instance is enough. Will also catch unstated assumptions (e.g. base image package set, UFW present by default, kernel version vs NetBird agent requirements).