Enables an nginx-proxy-manager proxy host (jellyfin:8096) so it can be reached by hostname on the LAN instead of IP:port. No public VIRTUAL_HOST/LETSENCRYPT_HOST since this stays internal-only for now. Claude-Session: https://claude.ai/code/session_01HZQK6jHmdTpFjFZM8FUnqA