Ingress and TLS on the box: a proxy for the forge, its wildcard and apps' own domains, on a staging name first #8946

Today Cloudflare's tunnel and the cluster ingress carry forge.open-platform.sh, *--forge.open-platform.sh children and the apps' domains. Replace with docs/EXTRACT.md step 4: Caddy with a DNS-challenge wildcard, on-demand TLS asking /__forge/domains/ask, or the tunnel pointed at the box. FORGE_TRUSTED_PROXIES and FORGE_CLIENT_IP_HEADER set for it.

Done when:

• [ ] The box answers on a staging name over TLS, including a child's host and an app's own domain.
• [ ] DNS cutover written as a runbook with its rollback (point the record back; the platform still serves until it is told otherwise); the TTL lowered a day before.
• [ ] The cutover itself waits for the owner's go in this issue.

Files: docs/EXTRACT.md, docs/DOMAINS.md, infra/forge-box/Caddyfile

Part of #7667 (inventory: docs/PLATFORM.md). Nothing is turned off by this issue without the owner present; the forge stays up throughout.