Docs: tested single-host install, NPM integration, installer --docker

- README: step-by-step installation of web UI and agent on one host,
  exactly as tested (agent after keygen, all "run" helpers before
  "up -d", http PUBLIC_URL and TRUSTED_PROXY_HOPS=0 without a proxy)
- README: attach to an existing Nginx Proxy Manager in Docker – shared
  network via docker-compose.override.yaml, no published port,
  gw_priority so SSH to the agent keeps the source address of the own
  network (otherwise from= rejects it), TLS settings, test
- install.sh --docker: the new manual jail bans in INPUT and DOCKER-USER
- Running container: helpers via "docker compose exec … python -m webui"
  (run fails with "Address already in use"); troubleshooting entries

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/reverse-proxy.md

@@ -14,6 +14,11 @@ IP-Adressen zu beschränken kostet wenig und ist dringend empfohlen.
 
 ## Nginx Proxy Manager
 
+Läuft NPM als Docker-Container auf demselben Host: die getestete Schritt-für-Schritt-Anleitung
+steht im [README](../README.md#hinter-einem-vorhandenen-nginx-proxy-manager-docker) (gemeinsames
+Docker-Netz, kein veröffentlichter Port, `gw_priority`, Sperren in `DOCKER-USER`).
+Für NPM auf einem anderen Host:
+
 **Hosts → Proxy Hosts → Add Proxy Host**
 
 | Feld | Wert |