docs(#11): WOO_BASE_URL in compose, HTTPS-only, Settings read-only

Check in implementable deploy/docker-compose.yml, .env.example, and Caddy
fragment. Store URL is env SoT (not a settings row). Application Password
setup stays in DEPLOYMENT §5 (issue #5).

deploy/docker-compose.yml

@@ -0,0 +1,41 @@
+# Implementable compose for SlabUploader (docs/refactor-v2).
+# From repo root:
+#   cp deploy/.env.example deploy/.env && chmod 600 deploy/.env
+#   docker compose -f deploy/docker-compose.yml --env-file deploy/.env up -d
+# Bind loopback only. Caddy is the TLS edge. Services on the compose network
+# are named `frontend` and `fastapi` (must match Caddyfile.fragment).
+#
+# WOO_BASE_URL is deploy-time SoT, HTTPS only. FastAPI must refuse http://
+# at startup. Settings UI displays the URL read-only.
+
+services:
+  frontend:
+    build:
+      context: ..
+      dockerfile: frontend/Dockerfile
+    ports: ["127.0.0.1:${FRONTEND_PORT:-18080}:80"]
+    depends_on: [fastapi]
+    restart: unless-stopped
+
+  fastapi:
+    build:
+      context: ..
+      dockerfile: backend/Dockerfile
+    env_file:
+      - .env
+    environment:
+      SLAB_AES_KEY: ${SLAB_AES_KEY}
+      WOO_BASE_URL: ${WOO_BASE_URL}
+      APP_HOSTNAME: ${APP_HOSTNAME:-}
+      # Woo Application Password + inference keys: AES-GCM in SQLite via Settings UI
+    volumes:
+      - slab_db:/data
+      - slab_images:/images
+      - ../prompts:/app/prompts:ro
+    ports: ["127.0.0.1:${FASTAPI_PORT:-18081}:8000"]
+    mem_limit: 2g
+    restart: unless-stopped
+
+volumes:
+  slab_db:
+  slab_images: