docs(#11): WOO_BASE_URL in compose, HTTPS-only, Settings read-only

Check in implementable deploy/docker-compose.yml, .env.example, and Caddy
fragment. Store URL is env SoT (not a settings row). Application Password
setup stays in DEPLOYMENT §5 (issue #5).

docs/DATA-MODEL.md

@@ -175,9 +175,10 @@ authoritative source for tag definitions; this table caches synced Woo tags.
 | `updated_at` | TEXT | |
 
 Keys (server settings; secrets encrypted at rest):
-- `woo_base_url`, `woo_wp_username`, `woo_app_password`
+- `woo_wp_username`, `woo_app_password`
   (username + WordPress application password for a dedicated low-priv WP user;
   not WooCommerce consumer keys)
+- Store URL is **not** a settings row: `WOO_BASE_URL` env (compose), HTTPS only
 - `inference_base_url`, `inference_api_key`, `inference_model`
 - `inference_enabled`, `content_llm_enabled`
 - `brand_voice`, `geo_context`