README wildcard-with-Kamal recipe configures the app containers, not the proxy

[mhenrixon]

Problem

README.md — "Enabling Wildcard Certificates in Kamal" (around line 948) — tells operators to configure DNS-01 like this:

env:
  clear:
    ACME_EMAIL: admin@example.com
    ACME_DNS_PROVIDER: cloudflare
  secret:
    - CF_API_TOKEN

env: in deploy.yml is app/role scoped. It becomes --env on the application containers. The kamal-proxy container is booted separately by kamal proxy boot, and Kamal::Commands::Proxy#run passes only:

*config_digest_label_args(digest),
*proxy_run_config.docker_options_args,   # apps volume, publish, log opts, expose, proxy.run.options
*proxy_run_config.image,
*proxy_run_config.run_command

No app env reaches it. Following this recipe gets you a proxy with no ACME email and no DNS credentials — --acme-dns-provider falls through to auto, auto-detection finds nothing, and wildcard issuance fails with a message that points at credentials the operator is certain they set.

The gem's own docs already have the right answer: lib/kamal/configuration/docs/proxy.yml (around line 198) documents proxy.run.options.env as the way to put KAMAL_PROXY_DOMAINS_TOKEN on the proxy container. The proxy README just never got the memo.

Proposed fix

Rewrite the section to use proxy.run.options.env, which is the only supported path today:

proxy:
  ssl: true
  host: app.example.com
  run:
    options:
      env:
        - ACME_EMAIL=admin@example.com
        - ACME_DNS_PROVIDER=cloudflare
        - CF_API_TOKEN=...

Call out the sharp edge honestly: this is a raw docker run passthrough, so it has no .kamal/secrets integration — the token ends up literal in deploy.yml unless the operator uses ERB. That is a real gap, not something to paper over; link it to the gem-side issue for a first-class proxy.run.acme block.

Acceptance criteria

• GIVEN an operator follows the README verbatim WHEN they run kamal proxy boot THEN docker inspect kamal-proxy shows the ACME variables on the proxy container
• GIVEN the secrets caveat THEN the README states it rather than showing a plaintext token with no comment

Notes

Found while auditing gem/proxy flag coverage for the 1.0.0.0 release. The env: clear: recipe has presumably never worked; it predates the flag audit.