Expand architecture: multi-site Phase 1, multi-domain TLS, fix review issues

Promote multi-site support from Phase 2 to Phase 1 (ADR-010): the proxy
must support git.alk.dev and alk.dev from initial release. Add multi-domain
TLS configuration (ADR-011): acme_domains array replaces acme_domain string,
single SAN certificate via rustls-acme.

Key changes:
- ADR-010: Multi-site in Phase 1 — avoids config format migration later
- ADR-011: Multi-domain TLS — single SAN cert, acme_domains Vec<String>
- ADR-002: Updated rationale for multi-site (one upstream per domain)
- overview.md: Phase 1 now includes multi-site, alk.dev pass-through,
  dual licensing (MIT OR Apache-2.0), real IP removed
- config.md: acme_domain → acme_domains, TOML example shows both sites,
  validation adds unique host check, real IP replaced with 203.0.113.10
- tls.md: Multi-domain SNI section moved from Future to current, manual
  mode uses ResolvesServerCert for SNI mapping, TOML header fixed
- proxy.md: Updated for multi-site, removed single-domain language
- operations.md: RFC 5737 documentation IPs, clarified rate limit eviction
  semantics (distinct scan interval vs eviction age)
- open-questions.md: OQ-05 resolved (single bind_addr sufficient), new
  OQ-07 (per-site TLS overrides)

Review fixes:
- acme_domains (plural) consistently used across all docs and diagram
- ADR-011 clearly scopes acme_domain as previous design
- Inline decision rationale extracted: tls.md hot-reload → ADR-004 ref,
  config.md static/dynamic → ADR-008 ref
- TOML section headers consistent (server.tls)

docs/architecture/proxy.md

@@ -14,8 +14,9 @@ injection, body size limits), and forwards it to the upstream service.
 ## Why It Exists
 
 This component replaces nginx's `proxy_pass` directive. For our use case —
-single upstream per domain, no load balancing, no HTTP/2 proxying — a custom
-handler is simpler and more maintainable than a general-purpose proxy library.
+one upstream per domain across multiple domains, no load balancing, no HTTP/2
+proxying — a custom handler is simpler and more maintainable than a
+general-purpose proxy library (ADR-002, ADR-010).
 
 ## Architecture
 
@@ -140,9 +141,9 @@ services typically run on the same host (e.g., `127.0.0.1:3000`). The
 `upstream_scheme` field in each site's configuration allows specifying `https://`
 for upstreams that require TLS (e.g., separate hosts or secure internal services).
 
-For the initial deployment (`git.alk.dev` → `127.0.0.1:3000`), the upstream
-connection uses plain HTTP, as TLS between the proxy and Gitea on loopback is
-unnecessary.
+For the initial deployment, upstream connections use plain HTTP (e.g.,
+`git.alk.dev` → `127.0.0.1:3000`, `alk.dev` → `127.0.0.1:8080`) since TLS
+between the proxy and backend services on loopback is unnecessary.
 
 ## Body Size Limit
 
@@ -157,8 +158,9 @@ All design decisions are documented as ADRs in [decisions/](decisions/).
 
 | ADR | Decision | Summary |
 |-----|----------|---------|
-| [002](decisions/002-custom-proxy-handler.md) | Custom proxy handler | Single upstream, single domain — simpler than a general proxy library |
+| [002](decisions/002-custom-proxy-handler.md) | Custom proxy handler | One upstream per domain — simpler than a general proxy library |
 | [007](decisions/007-custom-log-format.md) | Custom structured log format | key=value pairs with RATE_LIMIT prefix for fail2ban |
+| [010](decisions/010-multi-site-phase1.md) | Multi-site in Phase 1 | Multiple domains from initial release |
 
 ## Open Questions