Add a dedicated Git-managed stack that leaves the existing Nginx Proxy Manager bindings on ports 80/443 unchanged and publishes the Telegram endpoint only on 192.168.0.35:10443.\n\nTeleProxy direct-mode traffic is routed through an isolated Xray SOCKS5 client and the dedicated Hetzner VLESS+Reality egress at 89.167.72.79:443. Both upstream images are digest-pinned. Credential-bearing Xray and TeleProxy files remain root-controlled host files under /mnt/containers/telegram-reality and are explicitly excluded from Git.
