remove user-secrets approach & prepare a pilot deploy

deploy/Caddyfile

@@ -0,0 +1,21 @@
+# Balinyaar — the block to add to your EXISTING Caddyfile (the Caddy container that owns caddy_net).
+#
+# This is not loaded by anything in this repo; it is a copy of what DEPLOY.md tells you to paste, kept
+# here so the reverse-proxy contract lives next to the compose file that depends on it.
+#
+# Both upstreams are plain HTTP on the container network — Caddy is the only TLS terminator, and it
+# obtains/renews the certificates for both hostnames automatically.
+
+balinyaar.ir, www.balinyaar.ir {
+	encode zstd gzip
+	reverse_proxy balinyaar-web:3000
+}
+
+api.balinyaar.ir {
+	encode zstd gzip
+
+	# The API partitions its rate limiter on the client IP resolved from X-Forwarded-For, and trusts the
+	# docker bridge ranges listed under ForwardedHeaders:KnownNetworks. Caddy sets X-Forwarded-For and
+	# X-Forwarded-Proto by default, so no extra header directives are needed here.
+	reverse_proxy balinyaar-api:8080
+}