deploy(prod): swap NetBird-Traefik labels for off-stack proxy + internal Caddy

The stack no longer talks to any specific external proxy. Removed traefik.*
labels and the shared `traefik` external network from kong + app, and dropped
TRAEFIK_NETWORK / TRAEFIK_ENTRYPOINT / TRAEFIK_CERTRESOLVER from the .env
template and the deploy-script bootstrap.

Internal edge is a `caddy:2-alpine` container on the `colectivo` network,
publishing host port 3000. `infra/Caddyfile.erosi` does the path split:
/rest|/auth|/realtime|/storage|/graphql|/pg -> kong:8000, everything else
-> app:3000. Global block sets `auto_https off` + `admin off` so :3000 is
the only listener.

Whatever proxy fronts the host (NetBird's Traefik, nginx, anything) just
terminates TLS for erosi.limonia.net and forwards plain HTTP to
ambrosio:3000. Off-stack and out of this repo.

Docs (CLAUDE.md + docs/deployment.md) updated to describe the two-layer
edge. Includes the gotcha that bind-mounted file edits (Caddyfile) need
`docker compose restart caddy` since `up -d` won't recreate the container
on file-only changes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.erosi.example

@@ -21,13 +21,11 @@ PUBLIC_KEYCLOAK_REALM=your-realm
 PUBLIC_KEYCLOAK_CLIENT_ID=your-client-id
 KEYCLOAK_CLIENT_SECRET=CHANGEME-paste-from-external-keycloak
 
-# ── Traefik (deployed by NetBird's self-hosted installer on ambrosio) ──────
-# Copy these three values from what you answered during the NetBird install.
-# The Docker network name is mandatory (Traefik auto-discovers our kong+app
-# via labels only when we join the same network).
-TRAEFIK_NETWORK=netbird
-TRAEFIK_ENTRYPOINT=websecure
-TRAEFIK_CERTRESOLVER=letsencrypt
+# ── Reverse proxy ──────────────────────────────────────────────────────────
+# TLS + outermost routing live outside this repo. The stack exposes a single
+# host port (3000) where an internal Caddy fans out kong (Supabase API) vs
+# app (SvelteKit). Configure whatever external proxy you use to terminate
+# HTTPS for PUBLIC_APP_URL and forward plain HTTP to ambrosio:3000.
 
 # ── Postgres (single password for all internal roles) ───────────────────────
 POSTGRES_PASSWORD=CHANGEME-strong-random-password