fix: enable netbird agent network on existing proxy

Agent Network needs NB_PROXY_PRIVATE=true on the single existing
reverse-proxy, not a separate container. The previous standalone
an-proxy had no TLS cert (removed certs volume + ACME) and crashed
with 'open certs/tls.crt: no such file', so its overlay peer IP
(100.91.226.149) never came up and drop.p.az-gruppe.com timed out.

The auto-generated endpoint under the existing *.p.az-gruppe.com
wildcard (drop.p.az-gruppe.com -> overlay peer IP via MagicDNS) is
the correct URL; the invented a.az-gruppe.com had no DNS.

- set NB_PROXY_PRIVATE=true on netbird-proxy (keeps ACME + certs)
- remove standalone netbird-an-proxy container, anProxyIp, anProxyDomain
- drop netbird-an-proxy-env secret (nix refs + age file)

hosts/AZ-CLD-1/secrets.nix

@@ -61,9 +61,6 @@
       netbird-proxy-env = {
         file = ../../secrets/netbird-proxy-env.age;
       };
-      netbird-an-proxy-env = {
-        file = ../../secrets/netbird-an-proxy-env.age;
-      };
       outline-env = {
         file = ../../secrets/outline-env.age;
         owner = "outline";