* [self-hosted] Override relay auth secret and store encryption key from the environment
Combined server.authSecret and server.store.encryptionKey could only be
set in YAML, so operators could not keep config.yaml in git without
secrets. A non-empty NB_AUTH_SECRET or NB_STORE_ENCRYPTION_KEY now
overrides those fields after YAML is parsed and before defaults and
validation, matching the standalone relay env name for the auth secret.
* [self-hosted] Cover secret env overrides when no config path is given
LoadConfig with an empty path starts from DefaultConfig and applies
NB_AUTH_SECRET and NB_STORE_ENCRYPTION_KEY without reading YAML. The
existing tests only used YAML paths, so that branch had no coverage.
* Unified NetBird combined server (Management, Signal, Relay, STUN) as a single executable with richer YAML configuration, validation, and defaults.
* Official Dockerfile/image for single-container deployment.
* Optional in-process profiling endpoint for diagnostics.
* Multiplexing to route HTTP/gRPC/WebSocket traffic via one port; runtime hooks to inject custom handlers.
* **Chores**
* Updated deployment scripts, compose files, and reverse-proxy templates to target the combined server; added example configs and getting-started updates.
Matt Van Horn