deploy(prod): swap host Caddy for NetBird-Traefik labels + external Keycloak

Ambrosio's TLS is now handled by the Traefik that NetBird's self-hosted
installer deploys. kong + app attach to that Traefik network and expose
themselves via Docker-provider labels (erosi-kong priority 100 for
Supabase API paths, erosi-app priority 1 for everything else on
erosi.limonia.net). No container publishes host ports; host Caddy is
out of the deploy path permanently.

Keycloak is no longer bundled — PUBLIC_KEYCLOAK_URL points at an
external IdP. The deploy script writes .env with FILL_IN_* placeholders
for PUBLIC_KEYCLOAK_URL, KEYCLOAK_CLIENT_SECRET, and TRAEFIK_NETWORK,
and fails fast until they are filled.

New domain: erosi.limonia.net. realm-export.erosi.json is retained
as reference for the external Keycloak operator; it is no longer
imported by this stack.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

keycloak/realm-export.erosi.json

@@ -300,11 +300,11 @@
       "clientAuthenticatorType": "client-secret",
       "secret": "__KEYCLOAK_CLIENT_SECRET__",
       "redirectUris": [
-        "https://erosi.oier.ovh/*",
-        "https://erosi.oier.ovh/auth/v1/callback"
+        "https://erosi.limonia.net/*",
+        "https://erosi.limonia.net/auth/v1/callback"
       ],
       "webOrigins": [
-        "https://erosi.oier.ovh"
+        "https://erosi.limonia.net"
       ],
       "notBefore": 0,
       "bearerOnly": false,