switch to Caddy reverse proxy with auto HTTPS

Replace manual nginx + SSL certificates with Caddy for automatic
Let's Encrypt certificate management. Remove direct HTTP port exposure,
route web traffic through Caddy (80/443) via Docker internal network.
SSH remains on port 2222.

docker-compose.yml

@@ -8,13 +8,29 @@ services:
       - GITEA__lfs__PATH=${GITEA__lfs__PATH}
       - GITEA__service__DISABLE_REGISTRATION=${GITEA__service__DISABLE_REGISTRATION}
       - GITEA__server__SSH_PORT=${GITEA__server__SSH_PORT}
+      - GITEA__server__ROOT_URL=https://${DOMAIN}/
+      - GITEA__server__DOMAIN=${DOMAIN}
+      - GITEA__server__SSH_DOMAIN=${DOMAIN}
     restart: always
     volumes:
       - ./data:/data
     ports:
-      - "${HTTP_PORT}:3000"
       - "${SSH_PORT}:22"
 
+  caddy:
+    image: caddy:2
+    container_name: caddy
+    restart: always
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./caddy_data:/data
+      - ./caddy_config:/config
+    depends_on:
+      - gitea
+
 networks:
   default:
     driver: bridge