chore(deploy): drop Traefik labels, document Pangolin as the proxy

The compose service already joins the external `proxy` network and
exposes :8080; the reverse proxy owns TLS and routing. Remove the
Traefik router labels (and the now-unused FAMILIAR_DOMAIN /
TRAEFIK_CERTRESOLVER env vars) and document Pangolin — which discovers
the service on the shared network — as the proxy instead. nginx/Caddy
guidance is unchanged.

.env.example

@@ -40,7 +40,7 @@ FAMILIAR_DATA_DIR_HOST=./data
 # Writes off by default on a public instance. Set true to allow guarded writes.
 FAMILIAR_ENABLE_WRITES=false
 
-# --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
-# Only used if you run Traefik. For nginx/Caddy, see doc/deployment.md.
-FAMILIAR_DOMAIN=familiar.example.com
-TRAEFIK_CERTRESOLVER=letsencrypt
+# --- Reverse proxy --------------------------------------------------------- #
+# The container joins the external `proxy` network and exposes :8080; the proxy
+# (Pangolin, or nginx/Caddy — see doc/deployment.md) terminates TLS and forwards
+# to it. The public hostname and certs are configured in the proxy, not here.