feat: add HTTPS RPC proxy for MetaMask mobile support

Nginx SSL reverse proxy (port 8443) in front of Geth using Let's
Encrypt cert via Cloudflare DNS challenge. MetaMask mobile requires
HTTPS for custom RPC URLs.

Also adds AFC token icon served from bridge API static files.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker/docker-compose.dev.yml

@@ -134,6 +134,17 @@ services:
         limits:
           memory: 1G
 
+  rpc-ssl:
+    image: nginx:alpine
+    restart: unless-stopped
+    depends_on:
+      - geth
+    volumes:
+      - ./nginx/rpc-ssl.conf:/etc/nginx/nginx.conf:ro
+      - certbot_etc:/etc/letsencrypt:ro
+    ports:
+      - "8443:8443"
+
   afc-bridge:
     build:
       context: ../services/afc-bridge
@@ -160,3 +171,6 @@ volumes:
   minecraft_ftb_data:
   geth_data:
   afc_bridge_data:
+  certbot_etc:
+    external: true
+    name: docker_certbot_etc