docs(#11): WOO_BASE_URL in compose, HTTPS-only, Settings read-only

Check in implementable deploy/docker-compose.yml, .env.example, and Caddy
fragment. Store URL is env SoT (not a settings row). Application Password
setup stays in DEPLOYMENT §5 (issue #5).

deploy/Caddyfile.fragment

@@ -0,0 +1,14 @@
+# Merge into host Caddy. Replace {$APP_HOSTNAME} from inventory / .env.
+# handle /api/* MUST come before the frontend catch-all.
+
+{$APP_HOSTNAME} {
+	tls internal
+	handle /api/* {
+		reverse_proxy fastapi:8000
+	}
+	handle {
+		reverse_proxy frontend:80 {
+			header_up X-Real-IP {remote_host}
+		}
+	}
+}