feat: add Caddy reverse proxy in front of app

Caddy listens on port 80 and proxies to the app on 8000 internally.
App port is no longer exposed to the host directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Caddyfile

@@ -0,0 +1,3 @@
+:80 {
+	reverse_proxy app:8000
+}

docker-compose.yaml

@@ -1,9 +1,22 @@
 services:
+  caddy:
+    image: caddy:2-alpine
+    container_name: sneakyswole-proxy
+    ports:
+      - "80:80"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+    depends_on:
+      app:
+        condition: service_healthy
+    restart: unless-stopped
+
   app:
     image: git.sneakygeek.net/sneakygeek/sneakyswole:latest
     container_name: sneakyswole
-    ports:
+    expose:
-      - "${APP_PORT:-8000}:8000"
+      - "8000"
     volumes:
       - sneakyswole-data:/app/data
     env_file:
@@ -19,3 +32,5 @@ services:
 volumes:
   sneakyswole-data:
     driver: local
+  caddy-data:
+    driver: local