Move Open-WebUI to chat.${DOMAIN} subdomain

Open-WebUI's SvelteKit frontend hardcodes asset/API paths at build time,
so subpath hosting under /openwebui/ produced 404s on /_app/... assets.
Move it to its own subdomain so it can run at root.

- certbot: request cert with chat.${DOMAIN} as a third SAN via --expand
- nginx (prod): drop /openwebui blocks; add chat.${DOMAIN} HTTP redirect
  + HTTPS server with the existing admin auth gate
- nginx (dev): drop /openwebui blocks (no chat.localhost in dev)
- compose: WEBUI_URL points to https://chat.${DOMAIN}

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

certbot/entrypoint.sh

@@ -1,7 +1,8 @@
 #!/bin/sh
-if [ ! -d /etc/letsencrypt/live/${DOMAIN} ]; then
-    certbot certonly --webroot -w /var/www/certbot --email ${EMAIL} -d ${DOMAIN} -d www.${DOMAIN} --agree-tos --non-interactive;
-fi;
+certbot certonly --webroot -w /var/www/certbot \
+    --email ${EMAIL} \
+    -d ${DOMAIN} -d www.${DOMAIN} -d chat.${DOMAIN} \
+    --agree-tos --non-interactive --expand;
 
 trap exit TERM;