feat(deploy): add Docker build + Traefik-based production deployment

- Dockerfile: multi-stage pnpm monorepo build with Next.js standalone output
- .dockerignore: exclude node_modules, .next, .env, dev artifacts
- next.config.ts: enable `output: standalone` for slim runtime image
- compose.prod.yml: replace Caddy with Traefik labels, add migrate init
  service, split internal/external networks

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker/compose.prod.yml

@@ -1,7 +1,19 @@
+# Production stack — reverse proxy via external Traefik instance
+# Required env vars (set in Portainer or .env):
+#   DOMAIN            — e.g. epicure.example.com
+#   TRAEFIK_NETWORK   — Docker network Traefik listens on (e.g. traefik_proxy)
+#   CERT_RESOLVER     — Traefik certificate resolver name (e.g. letsencrypt)
+#   POSTGRES_DB / POSTGRES_USER / POSTGRES_PASSWORD
+#   REDIS_PASSWORD
+#   MINIO_ROOT_USER / MINIO_ROOT_PASSWORD
+#   BETTER_AUTH_SECRET / BETTER_AUTH_URL
+#   GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET
+#   OPENROUTER_API_KEY
+
 services:
   postgres:
     image: postgres:17-alpine
-    restart: always
+    restart: unless-stopped
     environment:
       POSTGRES_DB: ${POSTGRES_DB}
       POSTGRES_USER: ${POSTGRES_USER}
@@ -13,27 +25,55 @@ services:
       interval: 10s
       timeout: 5s
       retries: 5
+    networks:
+      - internal
 
   redis:
     image: redis:7-alpine
-    restart: always
+    restart: unless-stopped
     volumes:
       - redis_data:/data
     command: redis-server --save 60 1 --requirepass ${REDIS_PASSWORD}
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - internal
 
   minio:
     image: minio/minio:latest
-    restart: always
+    restart: unless-stopped
     environment:
       MINIO_ROOT_USER: ${MINIO_ROOT_USER}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
     volumes:
       - minio_data:/data
     command: server /data --console-address ":9001"
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - internal
+
+  migrate:
+    image: epicure-web:latest
+    command: ["node", "-e", "import('@epicure/db').then(m => m.migrate())"]
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: on-failure
+    networks:
+      - internal
 
   web:
     image: epicure-web:latest
-    restart: always
+    restart: unless-stopped
     environment:
       DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
       REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
@@ -46,32 +86,39 @@ services:
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
       GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
-    ports:
-      - "3000:3000"
     depends_on:
       postgres:
         condition: service_healthy
       redis:
-        condition: service_started
+        condition: service_healthy
       minio:
-        condition: service_started
-
-  caddy:
-    image: caddy:2-alpine
-    restart: always
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile
-      - caddy_data:/data
-      - caddy_config:/config
-    depends_on:
-      - web
+        condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.epicure.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.epicure.entrypoints=websecure"
+      - "traefik.http.routers.epicure.tls.certresolver=${CERT_RESOLVER}"
+      - "traefik.http.services.epicure.loadbalancer.server.port=3000"
+      # HTTP → HTTPS redirect
+      - "traefik.http.routers.epicure-http.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.epicure-http.entrypoints=web"
+      - "traefik.http.routers.epicure-http.middlewares=epicure-redirect"
+      - "traefik.http.middlewares.epicure-redirect.redirectscheme.scheme=https"
+      - "traefik.http.middlewares.epicure-redirect.redirectscheme.permanent=true"
+    networks:
+      - internal
+      - traefik
 
 volumes:
   postgres_data:
   redis_data:
   minio_data:
-  caddy_data:
-  caddy_config:
+
+networks:
+  internal:
+    driver: bridge
+  traefik:
+    external: true
+    name: ${TRAEFIK_NETWORK}