fix(3x-ui): restore reality443Forwarding — T10 removal broke Xray REALITY

Owner: 'reality443Forwarding точно ли стоило удалять? xray по прежнему
не работает, несмотря на то, что ssh и pubray1.zeroq.su работают.'

T10/C5 decision (б) was WRONG. modules/vds/nginx.nix was never touched
and still routes:
  pubray1.zeroq.su  → 127.0.0.1:2049  (panel)
  pubrayx1.zeroq.su → 127.0.0.1:15380 (Xray REALITY)
  default           → 127.0.0.1:15380 (fallback)

Removing the container mapping 127.0.0.1:15380:443/tcp made the nginx
stream forward TLS to a dead port → Xray REALITY unreachable. SSH and
pubray1.zeroq.su kept working because they do NOT depend on 15380.

Restored (exact pre-T10 code from 61b3724):
- modules/options.nix: reality443Forwarding option
- modules/vds/default.nix: reality443Forwarding = true
- modules/containers/3x-ui.nix: realityPorts binding + ports = basePorts ++ realityPorts
- manifest.json T10 → status 'pending' (reopened with corrected notes)

Verified: nix eval .#nixosConfigurations.otreca...3xui_app.ports =
  [..., '127.0.0.1:15380:443/tcp']

modules/containers/3x-ui.nix

@@ -30,6 +30,9 @@ let
     "127.0.0.1:2096:2096/tcp"
     "0.0.0.0:8443:8443/tcp"
   ];
+  # VDS-only: nginx stream forwards host:443 → 127.0.0.1:15380 →
+  # container:443, so Xray sees its REALITY inbound on port 443.
+  realityPorts = lib.optional config.host."3x-ui".reality443Forwarding "127.0.0.1:15380:443/tcp";
 in
 {
   # `host."3x-ui"` options are declared in modules/options.nix: they are set
@@ -62,7 +65,7 @@ in
           log-driver = "journald";
           # Adding a new inbound through the 3x-ui panel on a port outside
           # the 14380-15379 range requires extending basePorts and rebuilding.
-          ports = basePorts;
+          ports = basePorts ++ realityPorts;
         };
       };
     };