docs(#11): WOO_BASE_URL in compose, HTTPS-only, Settings read-only

Check in implementable deploy/docker-compose.yml, .env.example, and Caddy
fragment. Store URL is env SoT (not a settings row). Application Password
setup stays in DEPLOYMENT §5 (issue #5).

deploy/.env.example

@@ -0,0 +1,11 @@
+# Placeholders only. Copy to deploy/.env (chmod 600). Never commit real values.
+# Generate SLAB_AES_KEY: openssl rand -base64 32
+
+SLAB_AES_KEY=
+APP_HOSTNAME=slab.example.local
+FRONTEND_PORT=18080
+FASTAPI_PORT=18081
+
+# Plan of record: Woo store URL. HTTPS only. Not editable in Settings.
+# Server must reject http:// at startup.
+WOO_BASE_URL=https://www.whidbeywoodstore.com

deploy/Caddyfile.fragment

@@ -0,0 +1,14 @@
+# Merge into host Caddy. Replace {$APP_HOSTNAME} from inventory / .env.
+# handle /api/* MUST come before the frontend catch-all.
+
+{$APP_HOSTNAME} {
+	tls internal
+	handle /api/* {
+		reverse_proxy fastapi:8000
+	}
+	handle {
+		reverse_proxy frontend:80 {
+			header_up X-Real-IP {remote_host}
+		}
+	}
+}

deploy/INVENTORY.md

@@ -14,6 +14,7 @@ Do not assume a prior lab IP or hostname. See `docs/DEPLOYMENT.md`.
 | `APP_HOSTNAME` (HTTPS site name, e.g. `slab.example.local`) | |
 | OS / Docker version | |
 | Notes | |
+| `WOO_BASE_URL` (`https://` store; not editable in app) | |
 
 ## Ports and collisions
 

deploy/docker-compose.yml

@@ -0,0 +1,41 @@
+# Implementable compose for SlabUploader (docs/refactor-v2).
+# From repo root:
+#   cp deploy/.env.example deploy/.env && chmod 600 deploy/.env
+#   docker compose -f deploy/docker-compose.yml --env-file deploy/.env up -d
+# Bind loopback only. Caddy is the TLS edge. Services on the compose network
+# are named `frontend` and `fastapi` (must match Caddyfile.fragment).
+#
+# WOO_BASE_URL is deploy-time SoT, HTTPS only. FastAPI must refuse http://
+# at startup. Settings UI displays the URL read-only.
+
+services:
+  frontend:
+    build:
+      context: ..
+      dockerfile: frontend/Dockerfile
+    ports: ["127.0.0.1:${FRONTEND_PORT:-18080}:80"]
+    depends_on: [fastapi]
+    restart: unless-stopped
+
+  fastapi:
+    build:
+      context: ..
+      dockerfile: backend/Dockerfile
+    env_file:
+      - .env
+    environment:
+      SLAB_AES_KEY: ${SLAB_AES_KEY}
+      WOO_BASE_URL: ${WOO_BASE_URL}
+      APP_HOSTNAME: ${APP_HOSTNAME:-}
+      # Woo Application Password + inference keys: AES-GCM in SQLite via Settings UI
+    volumes:
+      - slab_db:/data
+      - slab_images:/images
+      - ../prompts:/app/prompts:ro
+    ports: ["127.0.0.1:${FASTAPI_PORT:-18081}:8000"]
+    mem_limit: 2g
+    restart: unless-stopped
+
+volumes:
+  slab_db:
+  slab_images: