- docker-compose.prod.yml reads POSTGRES_PASSWORD, HTTP(S)_PORT and
  SITE_ADDRESS from .env; caddy persists its config in a volume
- Caddyfile takes the site address from the environment — a DNS name
  turns on automatic HTTPS
- README: full first-transfer, domain/HTTPS, update and backup guide

Smoke-tested locally: fresh postgres migrates on boot, panel + /api
serve from one origin, SPA fallback works.

Co-Authored-By: Claude Code <noreply@anthropic.com>