Add P2 SaaS CI, P4 scheduled discovery, P6 agent bridge (Redis pub/sub), Caddyfile

- P2: Gitea Actions CI for SaaS backend (separate from Go agent CI)
- P4: ScheduledDiscovery with Redis distributed lock to prevent concurrent scans
- P6: AgentBridge — Redis pub/sub for SaaS↔agent communication (approvals + step results)
- Caddyfile: self-hosted reverse proxy with auto-TLS for all 6 products

products/Caddyfile

@@ -0,0 +1,44 @@
+# dd0c Self-Hosted Reverse Proxy
+# Auto-TLS via Let's Encrypt for all products
+#
+# Usage: caddy run --config Caddyfile
+# Requires: DNS records pointing *.dd0c.dev to your server
+{
+	email admin@dd0c.dev
+}
+
+# P1: LLM Cost Router (Rust proxy)
+route.dd0c.dev {
+	reverse_proxy localhost:3001
+}
+
+# P2: IaC Drift Detection
+drift.dd0c.dev {
+	reverse_proxy localhost:3002
+}
+
+# P3: Alert Intelligence
+alert.dd0c.dev {
+	reverse_proxy localhost:3003
+}
+
+# P4: Service Catalog
+portal.dd0c.dev {
+	reverse_proxy localhost:3004
+}
+
+# P5: AWS Cost Anomaly
+cost.dd0c.dev {
+	reverse_proxy localhost:3005
+}
+
+# P6: Runbook Automation
+run.dd0c.dev {
+	reverse_proxy localhost:3006
+}
+
+# Dashboard UIs (Cloudflare Pages in prod, local dev server here)
+app.dd0c.dev {
+	reverse_proxy localhost:5173
+}
+}