feat(infra): parameterize secrets, add Caddy reverse proxy for domain

All hardcoded passwords/keys replaced with env vars so .env controls
everything in both dev and production:
  - DB_PASSWORD, DB_CONNECTION_STRING, JWT_KEY
  - CORS_ORIGIN_*, ASPNETCORE_ENVIRONMENT
  - All ZarinPal/Kavenegar/Snappfood secrets

New files for tomorrow's domain setup:
  - Caddyfile        → routes all subdomains with auto TLS
  - docker-compose.caddy.yml → adds Caddy service to the stack

.env.example now has clear TODAY (IP) vs TOMORROW (domain) sections.
Fixed hardcoded ZarinPal MerchantId in docker-compose.full.yml.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.admin.yml

@@ -1,12 +1,12 @@
-# Meezi platform admin — use WITH main stack (shared Postgres + Redis)
+# Meezi admin stack — overlay on top of main compose
 #
-#   docker compose up -d postgres redis
+# Requires main stack (postgres + redis) to be running.
+# Usage:
 #   docker compose -f docker-compose.yml -f docker-compose.admin.yml up -d --build
 #
 # URLs:
-#   Admin web   http://localhost:3102/fa/admin/login
-#   Admin API   http://localhost:5081/swagger
-#   Health      http://localhost:5081/health
+#   Admin panel  http://SERVER:3102/fa/admin/login
+#   Admin API    http://SERVER:5081/swagger
 
 services:
   admin-api:
@@ -24,14 +24,15 @@ services:
       redis:
         condition: service_healthy
     environment:
-      ASPNETCORE_ENVIRONMENT: Development
+      ASPNETCORE_ENVIRONMENT: "${ASPNETCORE_ENVIRONMENT:-Development}"
       ASPNETCORE_URLS: http://+:8080
       RUN_MIGRATIONS: "false"
-      ConnectionStrings__DefaultConnection: Host=postgres;Port=5432;Database=meezi;Username=meezi;Password=meezi_local_pass
+      ConnectionStrings__DefaultConnection: "${DB_CONNECTION_STRING:-Host=postgres;Port=5432;Database=meezi;Username=meezi;Password=meezi_local_pass}"
       ConnectionStrings__Redis: redis:6379
-      Cors__Origins__0: http://localhost:${ADMIN_WEB_PORT:-3102}
-      Cors__Origins__1: http://localhost:3101
-      Kavenegar__ApiKey: ""
+      Jwt__Key: "${JWT_KEY:-dev-jwt-key-CHANGE-THIS-IN-PRODUCTION-min32chars}"
+      Cors__Origins__0: "${CORS_ADMIN_ORIGIN_0:-http://localhost:3102}"
+      Cors__Origins__1: "${CORS_ORIGIN_0:-http://localhost:3101}"
+      Kavenegar__ApiKey: "${KAVENEGAR_API_KEY:-}"
     ports:
       - "${ADMIN_API_PORT:-5081}:8080"
     healthcheck: