[Proxy] Don't track xray config.json (survives deploys); add config.json.example

The real Xray VPN config held credentials and was overwritten by git checkout on every deploy. Untrack it + gitignore it + ship config.json.example as the template, so the server-side config persists across redeploys.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -21,3 +21,6 @@ Thumbs.db
 # local dev run logs
 /run.log
 /run.err
+
+# Xray VPN config holds real credentials — keep it server-only.
+deploy/xray/config.json

deploy/xray/README.md

@@ -11,9 +11,12 @@ pointed at that proxy from the admin panel, and only ingestion traffic goes thro
 
 ## Setup
 
-1. **Put your config** in `deploy/xray/config.json`. Replace the `proxy` outbound with your
-   own vmess / vless / trojan outbound (templates below). Keep the `inbounds` and `routing`
-   sections as-is so the local SOCKS/HTTP ports stay the same.
+1. **Create your config** from the example (it is git-ignored, so deploys never overwrite it):
+   ```bash
+   cp deploy/xray/config.json.example deploy/xray/config.json
+   nano deploy/xray/config.json   # replace the `proxy` outbound with your vmess/vless/trojan
+   ```
+   Keep the `inbounds` and `routing` sections as-is so the local SOCKS/HTTP ports stay the same.
 
 2. **Start the sidecar** (it's behind a compose profile so normal deploys don't run it):
    ```bash