Add Fly.io deployment guide for Fleet and WAF containers

[NickCrew]

Description

Add a container-native Fly.io deployment path for users who want managed regions and Docker image deployment without Kubernetes. Fleet and WAF can be documented separately so operators can run the control plane, sensors, or both.

Call out what should be private, what can be public, and how Fleet/WAF telemetry endpoints are wired across apps or networks.

Acceptance Criteria

• Migrate synapse-waf to Rust 2024 edition #1 Fly.io guide covers Fleet API deployment with secrets, managed/external Postgres, Redis, health checks, WebSocket behavior, and migrations
• Cache parsed EvalContext data across body-phase and deferred WAF passes #2 Guide covers WAF container deployment with proxy/admin services, config mounting or secret injection, telemetry endpoint, and private admin defaults
• Instantiate and integrate HeaderProfiler for per-endpoint header anomaly detection #3 Guide includes sample fly.toml snippets or values for Fleet-only, WAF-only, and Fleet+WAF topologies

---

Migrated from backlog TASK-103.9 (synapse).