Add docker-compose example with HAProxy SNI router

Turnkey deployment: HAProxy on :443 peeks at the TLS SNI and routes
Telegram clients to mtg while forwarding everything else (including DPI
probes) to a real Caddy web server with automatic HTTPS.

This is the setup recommended in BEST_PRACTICES.md, packaged so that
operators can clone and run it with minimal configuration.

Refs: #458

contrib/sni-router/Caddyfile

@@ -0,0 +1,19 @@
+{
+	# Caddy listens on 8443 behind HAProxy, which passes raw TLS through.
+	# Caddy terminates TLS itself and auto-obtains a Let's Encrypt certificate.
+	#
+	# If your domain's DNS already points to this server, ACME HTTP-01 challenge
+	# works through the HAProxy http frontend (:80 → redirect).  For DNS-01
+	# or other ACME methods, see https://caddyserver.com/docs/automatic-https
+}
+
+{$DOMAIN}:8443 {
+	tls {
+		# Use the ACME HTTP-01 challenge on port 80.
+		# HAProxy forwards :80 as HTTP, so Caddy can answer the challenge
+		# if you add an acl exception in haproxy.cfg (see README), or use
+		# DNS-01 instead.
+	}
+	root * /srv
+	file_server
+}