Replace Traefik with host-webserver reverse proxy in prod deployment

The production host runs cPanel, which already owns ports 80/443 for
other sites on the box -- there's no Traefik there. docker-compose.prod.yml
now binds the api container to 127.0.0.1:8000 only; the host's own
Apache/LiteSpeed (via cPanel) reverse-proxies api.amdbs.net to it and
terminates TLS itself (AutoSSL). Dropped the external traefik-public
network requirement and Traefik labels entirely.

Also corrected a separate latent inaccuracy while touching this: a bare
`docker compose up` (not `docker stack deploy`) never actually honored
deploy.replicas -- docs now say so and point at `--scale` instead of
implying free multi-replica scaling that was never really happening.

README's Production deployment section rewritten with concrete steps:
Cloudflare DNS record, cPanel subdomain + reverse proxy, then compose up.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

docker-compose.prod.yml

@@ -1,12 +1,12 @@
-# Production-oriented topology (section 1/28): Traefik -> N stateless API
-# replicas -> PgBouncer -> PostgreSQL, plus Redis and independently-scaled
-# workers. Requires a pre-existing external Traefik network named
-# `traefik-public` and a populated `.env` (never commit real secrets).
+# Production-oriented topology (section 1/28): the host's own webserver
+# (cPanel/Apache or LiteSpeed -- already holding ports 80/443 for other
+# sites on the box) reverse-proxies to the API container on 127.0.0.1,
+# terminating TLS itself; there's no Traefik here. PgBouncer sits in front
+# of PostgreSQL, Redis and the worker are independently scaled. Requires a
+# populated `.env` (never commit real secrets).
 name: aurora-core
 
 networks:
-  traefik-public:
-    external: true
   aurora-internal:
     driver: bridge
 
@@ -97,19 +97,15 @@ services:
         condition: service_healthy
       migrate:
         condition: service_completed_successfully
-    networks: [traefik-public, aurora-internal]
+    networks: [aurora-internal]
+    # Bound to localhost only -- the host's own webserver (cPanel/Apache or
+    # LiteSpeed, already holding 80/443 for other sites on the box) terminates
+    # TLS for api.amdbs.net and reverse-proxies here. No Traefik on this box.
+    ports:
+      - "127.0.0.1:${AURORA_API_PORT:-8000}:8000"
     deploy:
-      replicas: 3
       resources:
         limits: { cpus: "1", memory: 1G }
-      labels:
-        - "traefik.enable=true"
-        - "traefik.docker.network=traefik-public"
-        - "traefik.http.routers.aurora-core-api.rule=Host(`${AURORA_API_HOST:-api.aurora.local}`)"
-        - "traefik.http.routers.aurora-core-api.entrypoints=websecure"
-        - "traefik.http.routers.aurora-core-api.tls.certresolver=letsencrypt"
-        - "traefik.http.services.aurora-core-api.loadbalancer.server.port=8000"
-        - "traefik.http.services.aurora-core-api.loadbalancer.healthcheck.path=/health"
 
   worker:
     build: