ClickStack with Blue

Operate one ClickStack deployment from non-secret colors.yml. Read references/configuration.md before changing configuration or running a lifecycle operation.

One public host serves both halves of the stack: Caddy terminates TLS, proxies OTLP/HTTP on /v1/{logs,traces,metrics} to the collector, and serves the HyperDX UI on everything else. Point an OTLP exporter at https://<clickstack-host> with the server-generated ingestion key as its authorization header.