Configure docker-compose for Coolify/Traefik deployment

Replace the host-port-published nginx service with one that joins an
external Docker network and routes entirely through Traefik labels
(HTTP->HTTPS redirect, TLS router, security-headers middleware), matching
the pattern used by other Coolify-deployed projects. Add .env.example for
TRAEFIK_ENABLED/TRAEFIK_HOST/NETWORK_NAME and document the new deploy flow
and local-preview alternative in the README.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,6 +1,23 @@
 services:
   web:
     build: .
-    ports:
-      - "8080:80"
     restart: unless-stopped
+    labels:
+      - "traefik.enable=${TRAEFIK_ENABLED:-false}"
+      - "traefik.http.middlewares.vpinball-redirect-web-secure.redirectscheme.scheme=https"
+      - "traefik.http.routers.vpinball-web.middlewares=vpinball-redirect-web-secure"
+      - "traefik.http.routers.vpinball-web.rule=Host(`${TRAEFIK_HOST}`)"
+      - "traefik.http.routers.vpinball-web.entrypoints=web"
+      - "traefik.http.routers.vpinball-web-secure.rule=Host(`${TRAEFIK_HOST}`)"
+      - "traefik.http.routers.vpinball-web-secure.tls.certresolver=resolver"
+      - "traefik.http.routers.vpinball-web-secure.entrypoints=web-secure"
+      - "traefik.http.routers.vpinball-web-secure.middlewares=security-headers@file"
+      - "traefik.http.services.vpinball-web-secure.loadbalancer.server.port=80"
+      - "traefik.docker.network=${NETWORK_NAME}"
+    networks:
+      - compose_network
+
+networks:
+  compose_network:
+    name: ${NETWORK_NAME}
+    external: true