feat(infra): parameterize secrets, add Caddy reverse proxy for domain

All hardcoded passwords/keys replaced with env vars so .env controls
everything in both dev and production:
  - DB_PASSWORD, DB_CONNECTION_STRING, JWT_KEY
  - CORS_ORIGIN_*, ASPNETCORE_ENVIRONMENT
  - All ZarinPal/Kavenegar/Snappfood secrets

New files for tomorrow's domain setup:
  - Caddyfile        → routes all subdomains with auto TLS
  - docker-compose.caddy.yml → adds Caddy service to the stack

.env.example now has clear TODAY (IP) vs TOMORROW (domain) sections.
Fixed hardcoded ZarinPal MerchantId in docker-compose.full.yml.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.full.yml

@@ -81,8 +81,8 @@ services:
       Kavenegar__ApiKey: ""
       Billing__DashboardBaseUrl: http://localhost:${WEB_PORT:-3101}
       Snappfood__WebhookSecret: meezi-dev-snappfood-secret
-      ZarinPal__MerchantId: "104c093d-2f5b-470d-978b-e4edefbf6cc8"
-      ZarinPal__Sandbox: "true"
+      ZarinPal__MerchantId: "${ZARINPAL_MERCHANT_ID:-}"
+      ZarinPal__Sandbox: "${ZARINPAL_SANDBOX:-true}"
     ports:
       - "${API_PORT:-5080}:8080"
     volumes: