Fix ACME HTTP-01 passthrough in HAProxy config

Add an ACL that routes /.well-known/acme-challenge/ requests on :80
to Caddy instead of redirecting to HTTPS, so Let's Encrypt certificate
issuance works out of the box.

Also simplify Caddyfile to use Caddy's http_port/https_port directives.

contrib/sni-router/haproxy.cfg

@@ -20,11 +20,16 @@ defaults
     timeout client  60s
     timeout server  60s
 
-# --- HTTP :80 — redirect to HTTPS -------------------------------------------
+# --- HTTP :80 — ACME challenges + redirect -----------------------------------
 
 frontend http
     bind *:80
     mode http
+
+    # Let Caddy answer ACME HTTP-01 challenges for Let's Encrypt.
+    acl is_acme path_beg /.well-known/acme-challenge/
+    use_backend web_acme if is_acme
+
     http-request redirect scheme https code 301
 
 # --- TLS :443 — SNI-based routing -------------------------------------------
@@ -45,3 +50,7 @@ backend mtg
 
 backend web
     server web web:8443
+
+backend web_acme
+    mode http
+    server web web:80