Add the Blacktip edge

The edge: per-IP TCP/UDP/HTTP/HTTPS/TLS listeners with port ranges and PROXY
protocol, WireGuard tunnel endpoint, logins in front of web ports (built-in
proxy or Traefik), health checks and failover, and mail egress with DKIM
signing and MTA-STS. Split out of the original single repository; depends on
Reef for the shared types.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,18 @@
+# Copy to .env (never commit it). Real environment variables win over this file.
+
+# Where Hammerhead is, and this edge's token (Server -> Edges -> Show command).
+BLACKTIP_HAMMERHEAD=https://hammerhead.example.com
+BLACKTIP_TOKEN=
+
+# UDP address for the WireGuard tunnel.
+#BLACKTIP_TUNNEL=:51820
+
+# Report local Docker containers so they can be picked as targets.
+#BLACKTIP_DOCKER=1
+
+# Serve http/https with Traefik (path to a Traefik v3 binary), and optionally
+# use DNS challenge for wildcard certificates. The provider's credentials go here
+# too, named exactly as Traefik documents for that provider.
+#BLACKTIP_TRAEFIK=/usr/local/bin/traefik
+#BLACKTIP_ACME_DNS=cloudflare
+#CF_DNS_API_TOKEN=