3x-ui: make module generic via xlib.services.3x-ui options

The 3x-ui container config was hardcoded for vds: it mounted the LE
cert for pubray1.zeroq.su and published host:15380→container:443 for
Xray REALITY. The server imports the same module but for x.zeroq.su
(no REALITY inbound, no cert needed by 3x-ui itself yet).

Add two options so each device picks what it needs:
  - xlib.services.3x-ui.certDomain: domain whose LE cert is mounted
    at /root/cert/{fullchain,key}.pem. null means no cert mount.
  - xlib.services.3x-ui.reality443Forwarding: when true, also publish
    host:15380→container:443 for nginx stream SNI-routed REALITY.

vds sets both. Server sets only certDomain (kept harmless; nginx
still terminates TLS for x.zeroq.su, so the mounted cert is unused
until/unless 3x-ui is reconfigured to terminate TLS itself).

modules/server/default.nix

@@ -44,6 +44,12 @@
     # ./trilium.nix
     # ./zerotier.nix
   ];
+  # Server's 3x-ui is the controller panel at x.zeroq.su (nginx HTTP
+  # terminates TLS upstream, no SNI-routing on 443 needed here because
+  # there are other vhosts on the same port). Cert is still mounted in
+  # case 3x-ui is later reconfigured to terminate TLS itself (e.g. for
+  # direct node-API access); nginx doesn't have to use it.
+  xlib.services."3x-ui".certDomain = "x.zeroq.su";
   systemd.tmpfiles.rules = [
     (xlib.helpers.mkTmpfile "d" "/mnt" "0755" "root" "root")
     (xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")