Add jumpers.stormcloudhills.com subdomain vhost (HTTP + HTTPS)

Serve /uploads/scj as jumpers.stormcloudhills.com. HTTP redirects to
HTTPS; HTTPS vhost uses certs mounted at /etc/apache2/ssl. Adds named
ServerName to the default vhost so it remains the catch-all, scaffolds
the docroot, and documents expected cert filenames.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/apache/ssl/README.md

@@ -0,0 +1,37 @@
+# Apache SSL certificates
+
+This directory is mounted into the container at `/etc/apache2/ssl` (see `docker-compose.yml`).
+Drop your TLS cert/key here. The actual `.crt`/`.key`/`.pem` files are gitignored — only this README is tracked.
+
+## Files expected by the vhost config
+
+For `jumpers.stormcloudhills.com` (`docker/apache/000-default.conf`):
+
+| File | Purpose |
+| --- | --- |
+| `jumpers.stormcloudhills.com.crt` | Server certificate (SSLCertificateFile) |
+| `jumpers.stormcloudhills.com.key` | Private key (SSLCertificateKeyFile) |
+| `jumpers.stormcloudhills.com.chain.crt` | Optional CA chain/bundle (uncomment SSLCertificateChainFile to use) |
+
+## Option A — Let's Encrypt (recommended for production)
+
+Issue a cert on the host with certbot, then copy/symlink it in:
+
+```sh
+certbot certonly --standalone -d jumpers.stormcloudhills.com
+cp /etc/letsencrypt/live/jumpers.stormcloudhills.com/fullchain.pem \
+   docker/apache/ssl/jumpers.stormcloudhills.com.crt
+cp /etc/letsencrypt/live/jumpers.stormcloudhills.com/privkey.pem \
+   docker/apache/ssl/jumpers.stormcloudhills.com.key
+```
+
+Restart Apache after each renewal: `docker compose restart web`.
+
+## Option B — Self-signed (local testing only; browsers will warn)
+
+```sh
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+  -keyout docker/apache/ssl/jumpers.stormcloudhills.com.key \
+  -out    docker/apache/ssl/jumpers.stormcloudhills.com.crt \
+  -subj "/CN=jumpers.stormcloudhills.com"
+```