feat: deploy MEV Control GUI to mev.defi-oracle.io (nginx, NPM, Cloudflare)

- Add nginx site template + sync-mev-control-gui-defi-oracle.sh
- NPM fleet: mev.defi-oracle.io + www.mev; Cloudflare set-mev-defi-oracle-dns.sh
- ip-addresses + .env.master.example: MEV_ADMIN_API_* and web root vars
- Runbook MEV_CONTROL_DEFI_ORACLE_IO_DEPLOYMENT.md; AGENTS, MASTER_INDEX, ALL_VMIDS

Made-with: Cursor

.env.master.example

@@ -95,6 +95,15 @@ NPM_URL_MIFOS=
 # SPA: default runtime base is {origin}/token-aggregation (nginx on 2410 proxies to Blockscout). Override only if needed:
 # In info-defi-oracle-138/.env.local (not this file): VITE_TOKEN_AGGREGATION_API_BASE=https://explorer.d-bis.org/token-aggregation
 
+# --- mev.defi-oracle.io (MEV Control GUI on nginx LXC 2410 by default) ---
+# MEV_ADMIN_API_HOST=192.168.11.11   # LAN host reachable from CT; mev-admin-api listen address
+# MEV_ADMIN_API_PORT=9090
+# MEV_DEFI_ORACLE_WEB_VMID=2410
+# MEV_DEFI_ORACLE_UPSTREAM_IP=      # NPM: forward_host override (default IP_INFO_DEFI_ORACLE_WEB)
+# MEV_DEFI_ORACLE_UPSTREAM_PORT=80
+# MEV_DEFI_ORACLE_EDGE_MODE=auto    # Cloudflare DNS script (same as info: auto|tunnel|public_ip)
+# MEV_DEFI_ORACLE_PUBLIC_IP=        # A-record mode WAN IP if not using tunnel
+
 # --- Keycloak Admin API (optional) ---
 # For scripts/deployment/keycloak-sankofa-ensure-client-redirects.sh — merge portal/admin redirect URIs.
 # KEYCLOAK_URL=https://keycloak.sankofa.nexus