feat(ui): admin-only root link and shared header navigation

docker-compose.yml

@@ -1,14 +1,16 @@
+name: mohfarawati-de
+
 services:
   app:
     build:
       context: .
       dockerfile: Dockerfile
-    container_name: moh-sass-app
+    container_name: moh-sass-de-app
     restart: unless-stopped
     environment:
       NODE_ENV: production
       NEXT_TELEMETRY_DISABLED: "1"
-      DATABASE_URL: ${DATABASE_URL:-postgresql://postgres:postgres@db:5432/moh_sass?schema=public}
+      DATABASE_URL: postgresql://postgres:postgres@db:5432/moh_sass?schema=public
       ADMIN_PASSWORD: ${ADMIN_PASSWORD:-change-me}
       ADMIN_AUTH_SECRET: ${ADMIN_AUTH_SECRET:-change-me-long-secret}
       ROOT_BASIC_AUTH_USER: ${ROOT_BASIC_AUTH_USER:-root}
@@ -16,6 +18,8 @@ services:
     depends_on:
       db:
         condition: service_healthy
+    ports:
+      - "3000:3000"
     healthcheck:
       test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:3000/api/health || exit 1"]
       interval: 15s
@@ -25,18 +29,16 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=proxy"
-      - "traefik.http.routers.mohfarawati.rule=Host(`mohfarawati.de`) || Host(`www.mohfarawati.de`)"
-      - "traefik.http.routers.mohfarawati.entrypoints=websecure"
-      - "traefik.http.routers.mohfarawati.tls=true"
-      - "traefik.http.routers.mohfarawati.tls.certresolver=cf"
-      - "traefik.http.services.mohfarawati.loadbalancer.server.port=3000"
+      - "traefik.http.routers.mohfarawati-de.rule=Host(`mohfarawati.de`) || Host(`www.mohfarawati.de`)"
+      - "traefik.http.routers.mohfarawati-de.entrypoints=web"
+      - "traefik.http.services.mohfarawati-de.loadbalancer.server.port=3000"
     networks:
       - appnet
       - proxy
 
   db:
     image: postgres:16-alpine
-    container_name: moh-sass-db
+    container_name: moh-sass-de-db
     restart: unless-stopped
     environment:
       POSTGRES_DB: moh_sass