dstack-ingress 2.0: switch from nginx to haproxy for L4 TCP proxying

Replace nginx L7 reverse proxy with HAProxy in TCP mode. This eliminates
HTTP-level inspection so all protocols (HTTP, WebSocket, gRPC, arbitrary
TCP) work transparently after TLS termination.

Key changes:
- Dockerfile: nginx base -> haproxy:3.1-bookworm, master-worker mode
- entrypoint.sh: generate haproxy.cfg instead of nginx conf, support
  ROUTING_MAP env var for multi-domain SNI-based routing
- renewal-daemon.sh: graceful reload via SIGUSR2 instead of nginx -s reload
- New build-combined-pems.sh: concat fullchain+privkey for HAProxy PEM format
- functions.sh: sanitize_target_endpoint accepts bare host:port
- Evidence serving: payload inspection on port 443 (default, opt-out via
  EVIDENCE_SERVER=false) + shared /evidences volume for backend serving
- Configurable L4 tuning: MAXCONN, TIMEOUT_CONNECT/CLIENT/SERVER
- Drop L7-only env vars (CLIENT_MAX_BODY_SIZE, PROXY_*_TIMEOUT) with warnings

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: h4x3rotab

custom-domain/dstack-ingress/Dockerfile

@@ -1,4 +1,6 @@
-FROM nginx@sha256:b6653fca400812e81569f9be762ae315db685bc30b12ddcdc8616c63a227d3ca
+FROM haproxy:3.1-bookworm
+
+USER root
 
 RUN --mount=type=bind,source=pinned-packages.txt,target=/tmp/pinned-packages.txt,ro \
     set -e; \
@@ -32,9 +34,10 @@ RUN --mount=type=bind,source=pinned-packages.txt,target=/tmp/pinned-packages.txt
 RUN mkdir -p \
     /etc/letsencrypt \
     /var/www/certbot \
-    /usr/share/nginx/html \
-    /etc/nginx/conf.d \
-    /var/log/nginx
+    /etc/haproxy/certs \
+    /var/run/haproxy \
+    /var/lib/haproxy \
+    /evidences
 
 # Install scripts with deterministic permissions via bind mount
 RUN --mount=type=bind,source=scripts,target=/tmp/scripts,ro \
@@ -62,4 +65,4 @@ ENV PYTHONUNBUFFERED=1
 COPY --chmod=666 .GIT_REV /etc/
 
 ENTRYPOINT ["/scripts/entrypoint.sh"]
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["haproxy", "-W", "-f", "/etc/haproxy/haproxy.cfg"]