How to use a private Docker registry: from install to login, push, and certificates

Self-host, then wire Docker: create HOSTED/PROXY/GROUP, fix login and x509, and complete push, pull, CI, and Kubernetes pulls.