fix: trusted-proxies, nginx configs, bootstrap ssh/ufw, add zkreml.cz template

nginx/zkreml.cz.conf

@@ -0,0 +1,18 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name ACCOUNT_DOMAIN;
+
+    # Webfinger a discovery endpointy – přesměruj na GoToSocial instanci
+    location = /.well-known/webfinger {
+        return 301 https://GTS_HOST$request_uri;
+    }
+
+    location = /.well-known/nodeinfo {
+        return 301 https://GTS_HOST$request_uri;
+    }
+
+    location = /.well-known/host-meta {
+        return 301 https://GTS_HOST$request_uri;
+    }
+}