deploy(prod): swap NetBird-Traefik labels for off-stack proxy + internal Caddy

The stack no longer talks to any specific external proxy. Removed traefik.*
labels and the shared `traefik` external network from kong + app, and dropped
TRAEFIK_NETWORK / TRAEFIK_ENTRYPOINT / TRAEFIK_CERTRESOLVER from the .env
template and the deploy-script bootstrap.

Internal edge is a `caddy:2-alpine` container on the `colectivo` network,
publishing host port 3000. `infra/Caddyfile.erosi` does the path split:
/rest|/auth|/realtime|/storage|/graphql|/pg -> kong:8000, everything else
-> app:3000. Global block sets `auto_https off` + `admin off` so :3000 is
the only listener.

Whatever proxy fronts the host (NetBird's Traefik, nginx, anything) just
terminates TLS for erosi.limonia.net and forwards plain HTTP to
ambrosio:3000. Off-stack and out of this repo.

Docs (CLAUDE.md + docs/deployment.md) updated to describe the two-layer
edge. Includes the gotcha that bind-mounted file edits (Caddyfile) need
`docker compose restart caddy` since `up -d` won't recreate the container
on file-only changes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

infra/Caddyfile.erosi

@@ -0,0 +1,11 @@
+{
+	auto_https off
+	admin off
+}
+
+:3000 {
+	@api path /rest/v1/* /auth/v1/* /realtime/v1/* /storage/v1/* /graphql/v1/* /pg/*
+
+	reverse_proxy @api kong:8000
+	reverse_proxy app:3000
+}

infra/docker-compose.erosi.yml

@@ -1,13 +1,13 @@
 name: colectivo-erosi
 
 # Production stack for ambrosio.
-# Domain: erosi.limonia.net (app + Supabase API, single-domain).
 # Keycloak: external — URL set via PUBLIC_KEYCLOAK_URL in .env.
 #
-# TLS + reverse proxy is handled by Traefik (deployed by NetBird's self-hosted
-# installer on ambrosio). `kong` and `app` attach to Traefik's Docker network
-# (name in ${TRAEFIK_NETWORK}) and expose themselves via traefik.* labels.
-# No container binds a host port.
+# Reverse proxy + TLS are owned externally and not described here. The stack
+# exposes nothing publicly — `kong` (8000) and `app` (3000) listen on the
+# internal `colectivo` Docker network only. Whatever proxy fronts the host is
+# responsible for reaching them (e.g. via the Docker network or by mapping
+# host ports).
 #
 # Bring up:    docker compose -f infra/docker-compose.erosi.yml --env-file .env up -d --build
 # Logs:        docker compose -f infra/docker-compose.erosi.yml logs -f
@@ -162,15 +162,7 @@ services:
     volumes:
       - ./kong.yml:/home/kong/temp.yml:ro
       - ./kong-start.sh:/home/kong/kong-start.sh:ro
-    networks: [colectivo, traefik]
-    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=${TRAEFIK_NETWORK}"
-      - "traefik.http.routers.erosi-kong.rule=Host(`erosi.limonia.net`) && (PathPrefix(`/rest/v1`) || PathPrefix(`/auth/v1`) || PathPrefix(`/realtime/v1`) || PathPrefix(`/storage/v1`) || PathPrefix(`/graphql/v1`) || PathPrefix(`/pg`))"
-      - "traefik.http.routers.erosi-kong.entrypoints=${TRAEFIK_ENTRYPOINT}"
-      - "traefik.http.routers.erosi-kong.tls.certresolver=${TRAEFIK_CERTRESOLVER}"
-      - "traefik.http.routers.erosi-kong.priority=100"
-      - "traefik.http.services.erosi-kong.loadbalancer.server.port=8000"
+    networks: [colectivo]
 
   # ── App (SvelteKit Node server) — built on the host from the repo ──────────
   # Build args bake the PUBLIC_* values into the client bundle (SvelteKit reqs).
@@ -195,22 +187,24 @@ services:
       PUBLIC_KEYCLOAK_CLIENT_ID: ${PUBLIC_KEYCLOAK_CLIENT_ID}
       PUBLIC_APP_URL: ${PUBLIC_APP_URL}
       NODE_ENV: production
-    networks: [colectivo, traefik]
-    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=${TRAEFIK_NETWORK}"
-      - "traefik.http.routers.erosi-app.rule=Host(`erosi.limonia.net`)"
-      - "traefik.http.routers.erosi-app.entrypoints=${TRAEFIK_ENTRYPOINT}"
-      - "traefik.http.routers.erosi-app.tls.certresolver=${TRAEFIK_CERTRESOLVER}"
-      - "traefik.http.routers.erosi-app.priority=1"
-      - "traefik.http.services.erosi-app.loadbalancer.server.port=3000"
+    networks: [colectivo]
+
+  # ── Internal edge: path-split kong vs app on a single port ────────────────
+  # Plain HTTP. TLS + outermost routing live on whatever external proxy
+  # fronts the host; that proxy only needs to know about port 3000.
+  caddy:
+    image: caddy:2-alpine
+    restart: always
+    depends_on: [kong, app]
+    volumes:
+      - ./Caddyfile.erosi:/etc/caddy/Caddyfile:ro
+    ports:
+      - "3000:3000"
+    networks: [colectivo]
 
 networks:
   colectivo:
     driver: bridge
-  traefik:
-    name: ${TRAEFIK_NETWORK}
-    external: true
 
 volumes:
   db-data:

infra/scripts/deploy-erosi.sh

@@ -9,13 +9,14 @@
 #   1. rsyncs repo → ambrosio:/opt/colectivo/
 #   2. if .env doesn't exist on server, generates secrets and writes it with
 #      placeholder values the operator must fill in (external Keycloak URL,
-#      Keycloak client secret, Traefik network name)
+#      Keycloak client secret)
 #   3. docker compose build + up -d
 #   4. applies DB migrations
 #
-# TLS + routing is handled by Traefik (deployed by NetBird's self-hosted
-# installer on ambrosio). This script never touches /etc/caddy/* or any host
-# reverse-proxy config — it only manages the Docker stack.
+# Internal edge is a Caddy container listening on host port 3000 — the
+# external proxy (TLS terminator, off-stack) forwards plain HTTP to
+# ambrosio:3000. This script never touches the host reverse-proxy config —
+# it only manages the Docker stack.
 #
 # Subsequent runs: rsync + rebuild app + rolling restart.
 
@@ -77,13 +78,6 @@ PUBLIC_KEYCLOAK_REALM=colectivo
 PUBLIC_KEYCLOAK_CLIENT_ID=colectivo-web
 KEYCLOAK_CLIENT_SECRET=FILL_IN_CLIENT_SECRET
 
-# Traefik (deployed by NetBird's self-hosted installer on ambrosio).
-# FILL_IN the network name the installer asked you for; defaults for
-# entrypoint + certresolver match NetBird's typical setup.
-TRAEFIK_NETWORK=FILL_IN_TRAEFIK_NETWORK
-TRAEFIK_ENTRYPOINT=websecure
-TRAEFIK_CERTRESOLVER=letsencrypt
-
 POSTGRES_PASSWORD=$POSTGRES_PASSWORD
 
 SUPABASE_JWT_SECRET=$SUPABASE_JWT_SECRET
@@ -95,17 +89,16 @@ REALTIME_SECRET_KEY_BASE=$REALTIME_SECRET_KEY_BASE
 EOF
 	chmod 600 .env
 	echo "--- Wrote .env (mode 600)."
-	echo "    Fill in: PUBLIC_KEYCLOAK_URL, KEYCLOAK_CLIENT_SECRET, TRAEFIK_NETWORK"
+	echo "    Fill in: PUBLIC_KEYCLOAK_URL, KEYCLOAK_CLIENT_SECRET"
 	echo "    then re-run this script."
 	exit 0
 fi
 
 # Every deploy: fail fast if the operator didn't finish the .env.
 if grep -q '^PUBLIC_KEYCLOAK_URL=FILL_IN_' .env \
-	|| grep -q '^KEYCLOAK_CLIENT_SECRET=FILL_IN_' .env \
-	|| grep -q '^TRAEFIK_NETWORK=FILL_IN_' .env; then
+	|| grep -q '^KEYCLOAK_CLIENT_SECRET=FILL_IN_' .env; then
 	echo "ERROR: /opt/colectivo/.env still contains FILL_IN_ placeholders." >&2
-	echo "       Fill in PUBLIC_KEYCLOAK_URL, KEYCLOAK_CLIENT_SECRET, TRAEFIK_NETWORK and retry." >&2
+	echo "       Fill in PUBLIC_KEYCLOAK_URL, KEYCLOAK_CLIENT_SECRET and retry." >&2
 	exit 1
 fi
 REMOTE