Add jumpers.stormcloudhills.com subdomain vhost (HTTP + HTTPS)

Serve /uploads/scj as jumpers.stormcloudhills.com. HTTP redirects to
HTTPS; HTTPS vhost uses certs mounted at /etc/apache2/ssl. Adds named
ServerName to the default vhost so it remains the catch-all, scaffolds
the docroot, and documents expected cert filenames.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/apache/000-default.conf

@@ -1,4 +1,6 @@
 <VirtualHost *:80>
+    ServerName www.alwisp.net
+    ServerAlias alwisp.net
     ServerAdmin webmaster@alwisp.net
     DocumentRoot /var/www/html
 
@@ -33,3 +35,64 @@
     ErrorLog ${APACHE_LOG_DIR}/error.log
     CustomLog ${APACHE_LOG_DIR}/access.log combined
 </VirtualHost>
+
+# Subdomain: jumpers.stormcloudhills.com -> /uploads/scj
+# HTTP: redirect everything to HTTPS
+<VirtualHost *:80>
+    ServerName jumpers.stormcloudhills.com
+    ServerAdmin webmaster@alwisp.net
+
+    RewriteEngine On
+    RewriteRule ^/?(.*)$ https://jumpers.stormcloudhills.com/$1 [R=301,L]
+
+    ErrorLog ${APACHE_LOG_DIR}/jumpers-error.log
+    CustomLog ${APACHE_LOG_DIR}/jumpers-access.log combined
+</VirtualHost>
+
+# HTTPS
+<IfModule mod_ssl.c>
+<VirtualHost *:443>
+    ServerName jumpers.stormcloudhills.com
+    ServerAdmin webmaster@alwisp.net
+    DocumentRoot /var/www/html/uploads/scj
+    DirectoryIndex index.html
+
+    SSLEngine on
+    SSLCertificateFile      /etc/apache2/ssl/jumpers.stormcloudhills.com.crt
+    SSLCertificateKeyFile   /etc/apache2/ssl/jumpers.stormcloudhills.com.key
+    # If your provider gives a separate CA chain/bundle, uncomment:
+    #SSLCertificateChainFile /etc/apache2/ssl/jumpers.stormcloudhills.com.chain.crt
+
+    <Directory /var/www/html/uploads/scj>
+        Options -Indexes +FollowSymLinks
+        AllowOverride All
+        Require all granted
+    </Directory>
+
+    # Security headers
+    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
+    Header always set X-Frame-Options "SAMEORIGIN"
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set X-XSS-Protection "1; mode=block"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+
+    # Compression
+    <IfModule mod_deflate.c>
+        AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json
+    </IfModule>
+
+    # Cache static assets
+    <IfModule mod_expires.c>
+        ExpiresActive On
+        ExpiresByType image/jpeg "access plus 1 month"
+        ExpiresByType image/png  "access plus 1 month"
+        ExpiresByType image/webp "access plus 1 month"
+        ExpiresByType image/svg+xml "access plus 1 month"
+        ExpiresByType text/css  "access plus 1 week"
+        ExpiresByType application/javascript "access plus 1 week"
+    </IfModule>
+
+    ErrorLog ${APACHE_LOG_DIR}/jumpers-ssl-error.log
+    CustomLog ${APACHE_LOG_DIR}/jumpers-ssl-access.log combined
+</VirtualHost>
+</IfModule>