Serve behind Traefik and rate limit password guesses

The deployment is a public hostname behind Traefik rather than a LAN-only
box, which changes two things.

TLS is now terminated by the proxy, so Basic credentials are no longer in
cleartext. The container publishes no ports: doing so would leave an
unencrypted copy of the app on the host, bypassing the proxy. The hostname
lives in .env rather than compose.yaml, so no infrastructure detail is
committed and the MIT publication option stays open.

The password is now the only thing between the internet and the app, and a
500 ms sleep is not a defence at that exposure. Wrong guesses are rate
limited per client address: five in a burst, then one per ten seconds,
answered with 429.

Two details that decide whether this works at all:

- a request with no Authorization header is not charged. That is the
  handshake every browser session opens with, and counting it would lock the
  household out for simply opening the app a few times.
- X-Forwarded-For is believed only when the connection arrived from a private
  address, i.e. through the proxy, and then only its last entry, which is the
  one the proxy observed. A direct client could otherwise forge a fresh
  address per attempt and walk past the limiter entirely.

None of this substitutes for a strong password. It removes brute force as a
practical route, nothing more. PRD §3, §9 and §10 are updated: "no external
internet exposure" is no longer true.

compose.yaml

@@ -2,16 +2,33 @@ services:
   app:
     image: ${FOODSTER_REPO:?set FOODSTER_REPO in .env}:${FOODSTER_TAG:-latest}
     restart: unless-stopped
-    # A bind mount rather than a named volume: the database sits in ./data on
-    # the host, where it can be listed, copied and backed up without going
-    # through the container engine. The image runs as UID 65534, so the
-    # container has to be told which host user owns that directory.
+
+    # The database is a bind mount, not a named volume: it sits in ./data on
+    # the host where it can be listed, copied and opened with any sqlite
+    # client. The image runs as UID 65534, so the container has to be told
+    # which host user owns that directory.
     user: "${FOODSTER_UID:-1000}:${FOODSTER_GID:-1000}"
-    ports:
-      - "${FOODSTER_PORT:-8080}:8080"
+    volumes:
+      - ./data:/data
+
     environment:
       FOODSTER_PASSWORD: ${FOODSTER_PASSWORD:?set FOODSTER_PASSWORD in .env}
       FOODSTER_DB: /data/foodster.db
       TZ: ${TZ:-Europe/Helsinki}
-    volumes:
-      - ./data:/data
+
+    # No published ports: Traefik reaches the container over the shared
+    # network. Publishing 8080 as well would put an unencrypted copy of the
+    # app on the host, bypassing TLS.
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.foodster.entrypoints=websecure
+      - traefik.http.routers.foodster.rule=Host(`${FOODSTER_HOST:?set FOODSTER_HOST in .env}`)
+      - traefik.http.routers.foodster.tls=true
+      - traefik.http.services.foodster.loadbalancer.server.port=8080
+      - traefik.docker.network=traefik
+    networks:
+      - traefik
+
+networks:
+  traefik:
+    external: true