refactor(docker): remove traefik compose, cleanup deploy folder

- Delete docker-compose.traefik.yml (redundant overlay)
- Remove Traefik service from docker-compose.prod.yml
- Add traefik external network and labels to api/web services in prod compose
- Add TRAEFIK_ENTRYPOINT env var to all Traefik router labels
- Remove deploy/ folder (portainer-stack.yml, .env examples, README)

Production compose now assumes external Traefik proxy on Docker network.
All environment variables come from host environment only.

docker-compose.prod.yml

@@ -1,42 +1,4 @@
 services:
-  traefik:
-    image: traefik:v3.1
-    command:
-      - --api.dashboard=true
-      - --providers.docker=true
-      - --providers.docker.exposedbydefault=false
-      - --entrypoints.web.address=:80
-      - --entrypoints.websecure.address=:443
-      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
-      - --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:-admin@example.com}
-      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
-      - --log.level=${TRAEFIK_LOG_LEVEL:-INFO}
-      - --accesslog=true
-      - --accesslog.format=json
-      - --metrics.prometheus=true
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - traefik-certs:/letsencrypt
-    networks:
-      - platform
-      - tools
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_DASHBOARD_SUBDOMAIN:-traefik}.${ROOT_DOMAIN:-localhost}`)
-      - traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
-      - traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
-      - traefik.http.routers.traefik-dashboard.service=api@internal
-      - traefik.http.routers.traefik-dashboard.middlewares=auth@file
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "traefik", "healthcheck"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-
   api:
     build:
       context: ./apps/api
@@ -58,12 +20,13 @@ services:
         condition: service_healthy
     networks:
       - platform
+      - traefik
     volumes:
       - api-data:/data
     labels:
       - traefik.enable=true
       - traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN:-localhost}`)
-      - traefik.http.routers.api.entrypoints=websecure
+      - traefik.http.routers.api.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
       - traefik.http.routers.api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.api.loadbalancer.server.port=8000
       - traefik.http.routers.api.middlewares=sec-headers@file
@@ -87,10 +50,11 @@ services:
       - api
     networks:
       - platform
+      - traefik
     labels:
       - traefik.enable=true
       - traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN:-localhost}`)
-      - traefik.http.routers.web.entrypoints=websecure
+      - traefik.http.routers.web.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
       - traefik.http.routers.web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.web.loadbalancer.server.port=8080
       - traefik.http.routers.web.middlewares=sec-headers@file
@@ -116,11 +80,10 @@ services:
 volumes:
   postgres-data:
   api-data:
-  traefik-certs:
 
 networks:
   platform:
     driver: bridge
-  tools:
-    driver: bridge
-    external: false
+  traefik:
+    name: ${TRAEFIK_NETWORK:-traefik}
+    external: true