chore(deploy): drop Traefik labels, document Pangolin as the proxy

The compose service already joins the external `proxy` network and
exposes :8080; the reverse proxy owns TLS and routing. Remove the
Traefik router labels (and the now-unused FAMILIAR_DOMAIN /
TRAEFIK_CERTRESOLVER env vars) and document Pangolin — which discovers
the service on the shared network — as the proxy instead. nginx/Caddy
guidance is unchanged.

doc/deployment.md

@@ -77,8 +77,8 @@ Pushing needs a Gitea PAT with `write:package` scope stored as the repo secret `
 
 ```bash
 cp .env.example .env
-# edit .env: FAMILIAR_HTTP_TOKEN (openssl rand -hex 32), FAMILIAR_DOMAIN,
-#            cert resolver, FAMILIAR_IMAGE (:latest prod / :dev dev channel)
+# edit .env: FAMILIAR_HTTP_TOKEN (openssl rand -hex 32),
+#            FAMILIAR_IMAGE (:latest prod / :dev dev channel)
 
 docker network create proxy    # once, if your reverse proxy doesn't own it yet
 
@@ -121,16 +121,11 @@ familiar.yourdomain.tld {
 
 Caddy fetches and renews the certificate automatically and streams by default.
 
-### Traefik (labels included)
+### Pangolin
 
-`docker-compose.yml` already carries Traefik router labels. Set in `.env`:
+The compose service exposes `:8080` on the shared external `proxy` network and carries no proxy-specific labels. In Pangolin, add a resource for `familiar` that forwards to `http://familiar:8080` (target the container's `/mcp` path), and let Pangolin terminate HTTPS. Make sure Pangolin's own container is attached to the same `proxy` network so it can reach the service by name. Your public URL is then `https://familiar.yourdomain.tld/mcp`.
 
-```
-FAMILIAR_DOMAIN=familiar.yourdomain.tld
-TRAEFIK_CERTRESOLVER=letsencrypt
-```
-
-Traefik terminates HTTPS and forwards to the container's port 8080 on the `proxy` network. Your public URL is then `https://familiar.yourdomain.tld/mcp`.
+Because streamable HTTP holds a long-lived response open, raise the read/response timeout on the familiar resource and disable response buffering if the option is exposed (same reasoning as the nginx `proxy_read_timeout` / `proxy_buffering off` above).
 
 ## Operational notes