refactor: swap web and api service order in traefik compose

Move web frontend before API service to resolve potential routing conflicts.

docker-compose.traefik.yml

@@ -39,6 +39,31 @@ services:
       - backend
     restart: unless-stopped
 
+  # Web Frontend
+  web:
+    build:
+      context: ./apps/web
+      dockerfile: Dockerfile
+      args:
+        VITE_API_BASE_URL: ${API_PUBLIC_URL:-https://${API_DOMAIN}}
+        VITE_APP_URL: ${WEB_PUBLIC_URL:-https://${WEB_DOMAIN}}
+    container_name: hq-web
+    environment:
+      VITE_API_BASE_URL: ${API_PUBLIC_URL:-https://${API_DOMAIN}}
+      VITE_APP_URL: ${WEB_PUBLIC_URL:-https://${WEB_DOMAIN}}
+    depends_on:
+      - api
+    networks:
+      - backend
+      - traefik
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.${TRAEFIK_ROUTER_PREFIX:-hq}-web.rule=Host(`${WEB_DOMAIN}`)"
+      - "traefik.http.routers.${TRAEFIK_ROUTER_PREFIX:-hq}-web.entrypoints=websecure"
+      - "traefik.http.routers.${TRAEFIK_ROUTER_PREFIX:-hq}-web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}"
+      - "traefik.http.services.${TRAEFIK_ROUTER_PREFIX:-hq}-web.loadbalancer.server.port=80"
+
   # API Service
   api:
     build:
@@ -82,32 +107,6 @@ services:
       - "traefik.http.routers.${TRAEFIK_ROUTER_PREFIX:-hq}-api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}"
       - "traefik.http.services.${TRAEFIK_ROUTER_PREFIX:-hq}-api.loadbalancer.server.port=8000"
 
-
-  # Web Frontend
-  web:
-    build:
-      context: ./apps/web
-      dockerfile: Dockerfile
-      args:
-        VITE_API_BASE_URL: ${API_PUBLIC_URL:-https://${API_DOMAIN}}
-        VITE_APP_URL: ${WEB_PUBLIC_URL:-https://${WEB_DOMAIN}}
-    container_name: hq-web
-    environment:
-      VITE_API_BASE_URL: ${API_PUBLIC_URL:-https://${API_DOMAIN}}
-      VITE_APP_URL: ${WEB_PUBLIC_URL:-https://${WEB_DOMAIN}}
-    depends_on:
-      - api
-    networks:
-      - backend
-      - traefik
-    restart: unless-stopped
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.${TRAEFIK_ROUTER_PREFIX:-hq}-web.rule=Host(`${WEB_DOMAIN}`)"
-      - "traefik.http.routers.${TRAEFIK_ROUTER_PREFIX:-hq}-web.entrypoints=websecure"
-      - "traefik.http.routers.${TRAEFIK_ROUTER_PREFIX:-hq}-web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}"
-      - "traefik.http.services.${TRAEFIK_ROUTER_PREFIX:-hq}-web.loadbalancer.server.port=80"
-
 volumes:
   postgres_data:
   redis_data: