chore(deploy): drop Traefik labels, document Pangolin as the proxy

The compose service already joins the external `proxy` network and
exposes :8080; the reverse proxy owns TLS and routing. Remove the
Traefik router labels (and the now-unused FAMILIAR_DOMAIN /
TRAEFIK_CERTRESOLVER env vars) and document Pangolin — which discovers
the service on the shared network — as the proxy instead. nginx/Caddy
guidance is unchanged.

docker-compose.yml

@@ -60,21 +60,11 @@ services:
       timeout: 10s
       retries: 3
       start_period: 10s
-    labels:
-      # --- Traefik TLS termination (Let's Encrypt) -------------------------- #
-      # Enable if your reverse proxy is Traefik on the external `proxy` network.
-      # Set FAMILIAR_DOMAIN and TRAEFIK_CERTRESOLVER in .env. For nginx/Caddy
-      # instead, ignore these labels — see doc/deployment.md.
-      traefik.enable: "true"
-      traefik.docker.network: proxy
-      traefik.http.routers.familiar.rule: Host(`${FAMILIAR_DOMAIN:-familiar.example.com}`)
-      traefik.http.routers.familiar.entrypoints: websecure
-      traefik.http.routers.familiar.tls: "true"
-      traefik.http.routers.familiar.tls.certresolver: ${TRAEFIK_CERTRESOLVER:-letsencrypt}
-      traefik.http.services.familiar.loadbalancer.server.port: "8080"
+    # No proxy labels: Pangolin discovers this service on the shared `proxy`
+    # network and forwards to :8080 — configure the route in Pangolin, not here.
 
 networks:
-  # Shared reverse-proxy network (Traefik/Caddy). Create once with:
+  # Shared reverse-proxy network (Pangolin). Create once with:
   #   docker network create proxy
   proxy:
     external: true