Add TCPShield / Proxy Protocol support

Adds enforced Proxy Protocol config and docs: a patch-set (config/patches/patch-set.json) that enables proxy protocol, whitelists TCPShield, and sets proxy/direct IPs; exposes PATCH_DEFINITIONS and mounts ./config/patches in docker-compose.yml; adds a featured "Proxy Protocol Support" entry to the dashboard mods page; and adds docs/tcpshield.md describing setup, verification, security model, and first-boot behavior.

dashboard/src/app/(panel)/mods/page.tsx

@@ -59,6 +59,13 @@ const FEATURED = [
     description:
       "Pre-generates the world around spawn so nobody lags exploring new chunks. Run `chunky radius 2000` then `chunky start` in Console.",
   },
+  {
+    slug: "proxy-protocol-support",
+    emoji: "🛡",
+    title: "Proxy Protocol Support",
+    description:
+      "Using TCPShield (or another proxy)? This restores players' real IPs so the Security page and IP bans work. Config is auto-enforced — see docs/tcpshield.md.",
+  },
 ];
 
 export default function ModsPage() {