feat: add HTTPS RPC proxy for MetaMask mobile support

Nginx SSL reverse proxy (port 8443) in front of Geth using Let's
Encrypt cert via Cloudflare DNS challenge. MetaMask mobile requires
HTTPS for custom RPC URLs.

Also adds AFC token icon served from bridge API static files.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker/nginx/rpc-ssl.conf

@@ -0,0 +1,32 @@
+events {
+    worker_connections 256;
+}
+
+http {
+    server {
+        listen 8443 ssl;
+        server_name play.consultoria-as.com;
+
+        ssl_certificate /etc/letsencrypt/live/play.consultoria-as.com/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/play.consultoria-as.com/privkey.pem;
+        ssl_protocols TLSv1.2 TLSv1.3;
+
+        # Geth JSON-RPC proxy
+        location / {
+            proxy_pass http://geth:8545;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header Content-Type application/json;
+
+            # CORS for MetaMask
+            add_header Access-Control-Allow-Origin * always;
+            add_header Access-Control-Allow-Methods "POST, GET, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type" always;
+
+            if ($request_method = OPTIONS) {
+                return 204;
+            }
+        }
+    }
+}