refactor(compose): drasl internal-only behind caddy

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -50,14 +50,15 @@ services:
     image: unmojang/drasl:latest
     container_name: drasl
     restart: unless-stopped
-    ports:
+    # Internal-only: no published host port. Reached via Caddy at
-      - "25585:25585"          # Drasl web UI + Yggdrasil API
+    # auth.${BASE_DOMAIN} (Caddy holds the network alias on mcnet).
     volumes:
       - ./drasl/config:/etc/drasl:ro
       - drasl_state:/var/lib/drasl
     networks:
       - mcnet
-    # No env vars needed — all config is in ./drasl/config/config.toml
+    # No env vars — config is the rendered ./drasl/config/config.toml
+    # (from config.toml.tmpl via tooling/render-config.sh).
 
   minecraft:
     image: itzg/minecraft-server:java21