feat: netbird agent network private proxy

Add dedicated NB_PROXY_PRIVATE=true reverse-proxy (netbird-an-proxy)
serving agent-network synth endpoints over the WireGuard overlay only.
Configured via NB_PROXY_* env vars, no domain/ACME/Traefik/host port.
Register netbird-an-proxy-env secret.

hosts/AZ-CLD-1/secrets.nix

@@ -61,6 +61,9 @@
       netbird-proxy-env = {
         file = ../../secrets/netbird-proxy-env.age;
       };
+      netbird-an-proxy-env = {
+        file = ../../secrets/netbird-an-proxy-env.age;
+      };
       outline-env = {
         file = ../../secrets/outline-env.age;
         owner = "outline";