switch to Caddy reverse proxy with auto HTTPS

Replace manual nginx + SSL certificates with Caddy for automatic
Let's Encrypt certificate management. Remove direct HTTP port exposure,
route web traffic through Caddy (80/443) via Docker internal network.
SSH remains on port 2222.

.gitignore

@@ -4,5 +4,9 @@ data/
 # 环境变量（可能包含敏感信息）
 .env
 
+# Caddy 数据
+caddy_data/
+caddy_config/
+
 # macOS
 .DS_Store