docs: add reverse-proxy topology + external-TLS conventions

Capture the cert + edge-proxy conventions worked through deploying the
helexa-bench UI:

- external-tls.md — publicly-trusted certs via Let's Encrypt (certbot,
  Cloudflare DNS-01, ECDSA, /root/.certbot-internal); the external
  counterpart to internal-tls.md. Decision rule: public name → LE,
  *.internal → internal CA.
- reverse-proxies.md — names the per-site edge proxies (oolon for
  kosherinata, hanzalova.internal for the office) and what sits behind
  each, the public-vs-mesh access paths + the "public names don't
  hairpin from inside the mesh" gotcha, per-vhost cert choice, nginx
  conventions, and the bench (bench.helexa.ai + bench.internal) worked
  example.
- readme + generic.md §11 cross-reference both.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

generic.md

@@ -536,7 +536,7 @@ templated `step@<name>` unit. That pattern is documented separately in
 **`internal-tls.md`**.
 
 ### Ingress
-- Per-site nginx reverse proxy terminates all WAN inbound 443.
+- Per-site nginx reverse proxy terminates all WAN inbound 443 (`oolon` for kosherinata, `hanzalova.internal` for the office). The named topology, the public-vs-mesh access paths (and the hairpin gotcha), and the per-vhost cert choice are in **`reverse-proxies.md`**; external (Let's Encrypt) cert provisioning in **`external-tls.md`**.
 - Public DNS via Cloudflare, **unproxied by default** (CF's mTLS origin-pull has been unreliable). Revisit if/when that changes.
 - nginx serves static frontends directly from `/var/www/<app>` and reverse-proxies API traffic to the internal host:port from `manifest.yml`.