CONFIGURED - Wire docker-compose to Traefik for first deploy

- Join the app to the external proxy network and drop the published host port
- Add Traefik labels for mohfarawati.de, www, and root.mohfarawati.de
- Parametrize network/entrypoint/certresolver via TRAEFIK_* env with sane defaults
- Pass ADMIN_HOST to the app and document production env in .env.example

.env.example

@@ -18,3 +18,14 @@ ADMIN_PASSWORD="change-me"
 ADMIN_AUTH_SECRET="replace-with-a-long-random-secret"
 ADMIN_BASIC_AUTH_USER="change-me"
 ADMIN_BASIC_AUTH_PASS="change-me"
+
+# --- Production only (server .env) ---
+# The full stack runs via docker-compose.yml behind Traefik. On the server set:
+#   NEXT_PUBLIC_SITE_URL="https://mohfarawati.de"
+#   NEXT_PUBLIC_ADMIN_URL="https://root.mohfarawati.de"
+#   ADMIN_HOST="root.mohfarawati.de"
+# Traefik wiring (override only if your server differs from the defaults):
+#   TRAEFIK_NETWORK="proxy"          # the external network Traefik is on
+#   TRAEFIK_ENTRYPOINT="websecure"   # HTTPS entrypoint name
+#   TRAEFIK_CERTRESOLVER="cf"        # cert resolver that covers *.mohfarawati.de
+# DATABASE_URL is set by docker-compose.yml to the internal db service — do not set it here.