Add TCPShield / Proxy Protocol support

Adds enforced Proxy Protocol config and docs: a patch-set (config/patches/patch-set.json) that enables proxy protocol, whitelists TCPShield, and sets proxy/direct IPs; exposes PATCH_DEFINITIONS and mounts ./config/patches in docker-compose.yml; adds a featured "Proxy Protocol Support" entry to the dashboard mods page; and adds docs/tcpshield.md describing setup, verification, security model, and first-boot behavior.

docker-compose.yml

@@ -45,6 +45,11 @@ services:
       # Modpack support (leave empty for lean Fabric; see docs/mods-and-modpacks.md)
       MODRINTH_MODPACK: ${MODRINTH_MODPACK:-}
 
+      # Enforce mod configs on every boot (proxy-protocol/TCPShield settings —
+      # see docs/tcpshield.md). Mods that rewrite their own config files can't
+      # clobber these: patches re-apply before each server start.
+      PATCH_DEFINITIONS: /patches/patch-set.json
+
       TZ: ${TZ:-UTC}
     ports:
       - "${MC_PORT:-25565}:25565"
@@ -52,6 +57,7 @@ services:
       - "${MAP_PORT:-8100}:8100"
     volumes:
       - ./data/mc:/data
+      - ./config/patches:/patches:ro
     mem_limit: ${MC_CONTAINER_MEM_LIMIT:-7g}
 
   # ── Scheduled world backups (itzg/mc-backup) ─────────────────────────────