ci(deploy): integrate with mirror-nginx instead of Caddy

The server's central mirror-nginx already owns 80/443 + manages TLS, so FlatRender
can't run its own Caddy there. Adapt the deploy to the host-port + reverse-proxy model:

- compose: Caddy moved behind `profiles: [edge]` (not started by default); frontend/
  gateway/minio host ports are now EDGE_BIND + FRONTEND_PORT/GATEWAY_PORT/MINIO_PORT
  (so they can avoid Gitea's :3000 etc.); postgres/render stay on HOST_BIND loopback.
- deploy/ENV_FILE.production.example: nginx model, pre-filled for flatrender.ir,
  host ports 1600/1605/1610, no Caddy/ACME vars.
- deploy/mirror-nginx-flatrender.conf: ready-to-paste server blocks routing
  flatrender.ir / api / storage → 171.22.25.73:{1600,1605,1610}.
- deploy/README.md: nginx integration + cert step.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.v2.yml

@@ -48,8 +48,8 @@ services:
     volumes:
       - miniodata:/data
     ports:
-      - "${HOST_BIND:-0.0.0.0}:9000:9000"
-      - "${HOST_BIND:-0.0.0.0}:9001:9001"
+      - "${EDGE_BIND:-0.0.0.0}:${MINIO_PORT:-9000}:9000"
+      - "${EDGE_BIND:-0.0.0.0}:${MINIO_CONSOLE_PORT:-9001}:9001"
     healthcheck:
       test: ["CMD-SHELL", "mc ready local || exit 1"]
       interval: 10s
@@ -253,7 +253,8 @@ services:
     container_name: fr2-gateway
     restart: unless-stopped
     ports:
-      - "${HOST_BIND:-0.0.0.0}:${GATEWAY_PORT:-8080}:8080"
+      # EDGE_BIND/port face the reverse proxy (mirror-nginx → 171.22.25.73:PORT).
+      - "${EDGE_BIND:-0.0.0.0}:${GATEWAY_PORT:-8080}:8080"
     environment:
       JWT_SECRET: "${JWT_SECRET}"
       IDENTITY_URL: "http://identity-svc:8080"
@@ -300,7 +301,7 @@ services:
     container_name: fr2-frontend
     restart: unless-stopped
     ports:
-      - "${HOST_BIND:-0.0.0.0}:3000:3000"
+      - "${EDGE_BIND:-0.0.0.0}:${FRONTEND_PORT:-3000}:3000"
     environment:
       NODE_ENV: production
       PORT: "3000"
@@ -330,6 +331,10 @@ services:
     image: caddy:2-alpine
     container_name: fr2-caddy
     restart: unless-stopped
+    # Opt-in only: `docker compose --profile edge up`. NOT started by default —
+    # on a server with an existing reverse proxy (mirror-nginx owns 80/443),
+    # FlatRender publishes host ports and the proxy routes the domains to them.
+    profiles: ["edge"]
     ports:
       - "80:80"
       - "443:443"