feat: add Nginx to Caddy migration toolkit with scripts and usage guide

setup/nginx-to-caddy/README.md

@@ -0,0 +1,44 @@
+# Nginx to Caddy Toolkit
+
+Purpose: inventory an existing Nginx reverse-proxy setup and generate a first-pass Caddyfile for simple host/path proxying.
+
+This module is intentionally conservative:
+- it auto-converts common/basic patterns
+- it flags complex directives for manual review
+- it never edits live Nginx config
+
+## Scripts
+
+- `extract_nginx_inventory.sh`
+  - SSH into a host and collect `nginx -T`, `/etc/nginx` tarball, and a quick inventory summary.
+- `nginx_to_caddy.sh`
+  - Convert basic Nginx server blocks into a generated Caddyfile.
+- `validate_caddy.sh`
+  - Run `caddy fmt`, `caddy adapt`, and `caddy validate` on the generated Caddyfile.
+
+## Quick Start
+
+```bash
+cd setup/nginx-to-caddy
+
+./extract_nginx_inventory.sh --host=<host> --user=<user> --port=22 --yes
+./nginx_to_caddy.sh --input=./output/nginx-full.conf --output=./output/Caddyfile.generated --tls-mode=cloudflare --yes
+./validate_caddy.sh --config=./output/Caddyfile.generated --docker
+```
+
+## Conversion Scope
+
+Automatically handled:
+- `server_name`
+- `listen` (80/443 hints)
+- `ssl_certificate`, `ssl_certificate_key`
+- `return 301/302 ...`
+- `location` + `proxy_pass` (simple prefix or exact path)
+
+Manual follow-up required for:
+- regex locations (`~`, `~*`)
+- `rewrite`, `try_files`, `if`, `map`
+- FastCGI/uWSGI/SCGI/gRPC backends
+- auth subrequests, Lua, or advanced caching directives
+
+See `USAGE_GUIDE.md` for a safe migration workflow.