fix: enable netbird agent network on existing proxy

Agent Network needs NB_PROXY_PRIVATE=true on the single existing
reverse-proxy, not a separate container. The previous standalone
an-proxy had no TLS cert (removed certs volume + ACME) and crashed
with 'open certs/tls.crt: no such file', so its overlay peer IP
(100.91.226.149) never came up and drop.p.az-gruppe.com timed out.

The auto-generated endpoint under the existing *.p.az-gruppe.com
wildcard (drop.p.az-gruppe.com -> overlay peer IP via MagicDNS) is
the correct URL; the invented a.az-gruppe.com had no DNS.

- set NB_PROXY_PRIVATE=true on netbird-proxy (keeps ACME + certs)
- remove standalone netbird-an-proxy container, anProxyIp, anProxyDomain
- drop netbird-an-proxy-env secret (nix refs + age file)

hosts/AZ-CLD-1/services/containers/netbird.nix

@@ -18,7 +18,6 @@
   dashboardIp = "${ipBase}.${toString ipOffset}";
   serverIp = "${ipBase}.${toString (ipOffset + 1)}";
   proxyIp = "${ipBase}.${toString (ipOffset + 2)}";
-  anProxyIp = "${ipBase}.${toString (ipOffset + 3)}";
 
   # Database configuration
   dbName = "netbird";
@@ -95,7 +94,6 @@ in {
   age.secrets."${serviceName}-dashboard-env".file = ../../../../secrets/${serviceName}-dashboard-env.age;
   age.secrets."${serviceName}-server-env".file = ../../../../secrets/${serviceName}-server-env.age;
   age.secrets."${serviceName}-proxy-env".file = ../../../../secrets/${serviceName}-proxy-env.age;
-  age.secrets."${serviceName}-an-proxy-env".file = ../../../../secrets/${serviceName}-an-proxy-env.age;
 
   # Systemd oneshot service to generate config with secrets
   systemd.services."${serviceName}-config" = {
@@ -154,6 +152,14 @@ in {
       volumes = [
         "${serviceName}_proxy_certs:/certs"
       ];
+      environment = {
+        # Enable private services (NetBird Agent Network). Reachable only
+        # over the WireGuard overlay; endpoints are auto-generated under the
+        # proxy domain (e.g. <name>.p.az-gruppe.com) with a MagicDNS record
+        # pointing at this proxy's overlay peer IP. TLS is still terminated
+        # here via the existing ACME wildcard cert.
+        NB_PROXY_PRIVATE = "true";
+      };
       environmentFiles = [config.age.secrets."${serviceName}-proxy-env".path];
       cmd = [
         "--domain=${proxyDomain}"
@@ -169,22 +175,6 @@ in {
         "--network=web"
       ];
     };
-
-    "${serviceName}-an-proxy" = {
-      image = "netbirdio/reverse-proxy:latest";
-      autoStart = true;
-      environment = {
-        NB_PROXY_PRIVATE = "true";
-        NB_PROXY_MANAGEMENT_ADDRESS = "http://${serverIp}:80";
-        NB_PROXY_ALLOW_INSECURE = "true";
-      };
-      environmentFiles = [config.age.secrets."${serviceName}-an-proxy-env".path];
-      dependsOn = ["${serviceName}-server"];
-      extraOptions = [
-        "--ip=${anProxyIp}"
-        "--network=web"
-      ];
-    };
   };
 
   services.traefik.dynamicConfigOptions = {