Configure docker-compose for Coolify/Traefik deployment

Replace the host-port-published nginx service with one that joins an
external Docker network and routes entirely through Traefik labels
(HTTP->HTTPS redirect, TLS router, security-headers middleware), matching
the pattern used by other Coolify-deployed projects. Add .env.example for
TRAEFIK_ENABLED/TRAEFIK_HOST/NETWORK_NAME and document the new deploy flow
and local-preview alternative in the README.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -67,13 +67,24 @@ server needed to serve it.
 
 ## Docker deploy
 
+No secrets or registry authentication are required to build the image.
+
+The compose file is set up for a [Coolify](https://coolify.io)/Traefik deployment: it joins an
+external Docker network and routes entirely through Traefik labels, with no host port published.
+Copy `.env.example` to `.env` and set:
+
+- `TRAEFIK_ENABLED=true`
+- `TRAEFIK_HOST` — the domain to route to this service
+- `NETWORK_NAME` — the external Docker network Traefik and this service both join (Coolify
+  provisions this automatically for projects deployed through it)
+
 ```bash
-docker compose build
-docker compose up -d
+docker compose up -d --build
 ```
 
-Serves the static build via nginx on `http://localhost:8080`. No secrets or registry
-authentication are required to build the image.
+There's no local-only mode — without Traefik routing to it, the container isn't reachable from
+the host. To preview the static build locally instead, run `pnpm build` and serve `out/` with any
+static file server (e.g. `npx serve out`).
 
 ## PWA