fix: HAProxy batch commands and improve routing/subdomain handling

- Fix haproxy_cmd_batch to send each command on separate connection
  (HAProxy Runtime API only processes first command on single connection)
- HTTP frontend now routes to backends instead of redirecting to HTTPS
- Add subdomain detection to avoid duplicate wildcard entries
- Add reload verification with retry logic
- Optimize SSL: TLS 1.3 ciphersuites, extended session lifetime
- Add CPU steal monitoring script

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

scripts/check-steal.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+STEAL=$(vmstat 1 2 | tail -1 | awk '{print $17}')
+if [ "$STEAL" -gt 5 ]; then
+    echo "$(date): CPU steal high: ${STEAL}%" >> /var/log/cpu-steal.log
+fi