fix: enable netbird agent network on existing proxy

Agent Network needs NB_PROXY_PRIVATE=true on the single existing
reverse-proxy, not a separate container. The previous standalone
an-proxy had no TLS cert (removed certs volume + ACME) and crashed
with 'open certs/tls.crt: no such file', so its overlay peer IP
(100.91.226.149) never came up and drop.p.az-gruppe.com timed out.

The auto-generated endpoint under the existing *.p.az-gruppe.com
wildcard (drop.p.az-gruppe.com -> overlay peer IP via MagicDNS) is
the correct URL; the invented a.az-gruppe.com had no DNS.

- set NB_PROXY_PRIVATE=true on netbird-proxy (keeps ACME + certs)
- remove standalone netbird-an-proxy container, anProxyIp, anProxyDomain
- drop netbird-an-proxy-env secret (nix refs + age file)

secrets/netbird-an-proxy-env.age

@@ -1,18 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpoVnNlZyBUSEt1
-dDRNMDNRUE9hblgyZ1lFTWw0VUUvTFkwNmNZY1JRUjhzbURHOWprClcwYWIvUzFO
-RHZkcUY3LzZUZ2JzNyszbmNlZmY2NXFDSkdRSW5DK3BrYU0KLT4gc3NoLWVkMjU1
-MTkgU3JIYXFBIEtOZ3JoOFVMTUVEWC8veHBtbjJkSVBacWNwNXNZUmlnTjF6dm55
-WUxmUWsKWlFOZUtvTzVBMnhLa1RQS2hvbVhrTVJrdXNhT1IzeGVWMnlzV0pxNnFn
-OAotPiBzc2gtZWQyNTUxOSBsR3FWWmcgM3cxOXl4cmpkSGVpbUoxbHR5R0lOZzZq
-QzNjZzdjR0h1czRUYlNsUWh4RQo4aEt5c1c3L0hpTWIxM2NSSkJCQTZDelY5QjNr
-N2o3ZENiVEVPVTR5dkNNCi0+IHNzaC1lZDI1NTE5IENTTXloZyB2V1ZXVEt1OFNh
-bjExdmwxaGViNGxhMEgyQ3doR3Y1WmJxNXZJZEJudjBFCjNxTm5kdjhJamNQZTZI
-d1Q4YTduWERvdi9GcHc0RnUrbDZzNnNiM2JaS2sKLT4gdiJ4MTNtQS1ncmVhc2Ug
-WEpqIExhCjVoaGloejNVdlFvZkNmTjQ5NWwvRUZUN3p0dnhBZnAzUjdsWm1sS1ov
-Mzl1VU9JTDd0VWxRUXRMVFdnVXhZbE0KcytsQk5XMTdLWnlrWkljcjYwVXpEd3Jr
-V3NQN0pxYy8KLS0tIGptR2lpaWFqREVHMFhLMVJDWEI1YnowbzN4YlcyeVBpbkRM
-SUdodFgxdEkKECUqJhsp+j5b+yAdeu7FWtu9BK77JWm/JuhZHdQe8ZfXk3yU55Ib
-bNdBpVgq3i1rmGhPjwiSVlU/eYO46DXIwBDTlJkO7yWL0joSx3Pn/L+gcQZjHsNR
-1g==
------END AGE ENCRYPTED FILE-----