- Caddyfile: disable auto_https and admin, listen on :80 only
- docker-compose: bind port only on 127.0.0.1 to avoid public exposure
- bootstrap/app.php: trust all proxies so Laravel generates correct URLs
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>