docs: README + casdoor-auth guide for the v1.3 changes

- README: Traefik edge (app at http://localhost), single postgres (casdoor
  DB inside), prod overlay usage, partial receipts, admin panel, dev-mode
  3-step flow, layout for infra/ and 02-casdoor-db.sql
- docs/casdoor-auth.md: new section «Stack changes in this release» (DB
  merge, Traefik, RBAC, partial receipt, calendar, upload, project filter),
  updated addresses and redirect-URI notes

README.md

@@ -5,20 +5,26 @@ folder — no external files or sibling folders required.
 
 | Service | Container | Tech | Exposed port |
 |---|---|---|---|
-| **postgres** | `procurement-postgres` | PostgreSQL 18 | `5433` |
+| **postgres** | `procurement-postgres` | PostgreSQL 18 (one instance: `procurement` + `casdoor` DBs) | `5433` |
 | **minio** | `procurement-minio` | MinIO object storage (S3-compatible) | `9000` (API), `9001` (console) |
 | **casdoor** | `procurement-casdoor` | Casdoor (OIDC identity provider) | `8080` |
 | **api** | `procurement-api` | FastAPI + SQLAlchemy (asyncpg) | `8000` |
-| **frontend** | `procurement-frontend` | React 19 + Vite, served by nginx | `3000` |
+| **frontend** | `procurement-frontend` | React 19 + Vite, served by nginx (internal) | via Traefik |
+| **traefik** | `procurement-traefik` | Traefik v3 — public reverse proxy (edge) | `80` (web), `443` (websecure) |
 
 ```
-Browser ──► frontend :3000 (nginx SPA)
+Browser ──► Traefik :80 (edge)
                 │
-                └── /api/* proxy ──► api :8000 (FastAPI, /api/v1)
-                                          │
-                                          ├── postgres :5432 (procurement DB)
-                                          ├── minio :9000 (invoice/proforma files, bucket `procurement-files`)
-                                          └── casdoor :8000 (OIDC — login for the inventory panel)
+                ├── Host(localhost) ──► frontend (nginx SPA :80)
+                │                            │
+                │                            └── /api/* proxy ──► api :8000 (/api/v1)
+                │
+                ├── Host(api.localhost) ──► api :8000
+                ├── Host(auth.localhost) ──► casdoor :8000 (OIDC login)
+                └── Host(s3/storage.localhost) ──► minio (API / console)
+                                  │
+                                  ├── postgres :5432 (procurement + casdoor DBs)
+                                  └── minio :9000 (invoice/proforma files)
 ```
 
 ---
@@ -28,11 +34,15 @@ Browser ──► frontend :3000 (nginx SPA)
 ```text
 v1.3/
 ├── docker-compose.yml        ← all paths are relative to this folder
+├── docker-compose.prod.yml   ← production overlay (real domains + HTTPS via Let's Encrypt)
 ├── start.ps1                 ← PowerShell helper (build + start + status)
 ├── mc.cmd                    ← MinIO Client helper (inspect the bucket)
 ├── README.md
 ├── sql/
-│   └── migration.sql         ← DB schema v2.6 (auto-runs on first boot)
+│   ├── migration.sql         ← DB schema v2.6 (auto-runs on first boot)
+│   └── 02-casdoor-db.sql     ← creates the `casdoor` role+DB on the same instance
+├── infra/
+│   └── traefik-dynamic.yml   ← Traefik shared middlewares (HTTP→HTTPS redirect)
 ├── docs/                     ← ERDs + migration plan + auth guide
 │   ├── erd.txt               (v2.4 — old procurement schema)
 │   ├── new erd.txt           (v2.5 — material → supplier → category)
@@ -83,13 +93,18 @@ no browser redirect to Casdoor.
   «کالاهای در راه» (receiving included) and «سازمان‌دهی» (users, PMs, warehouses).
   The «انبارها» and «تغییر موجودی» sections are PM-only.
 
-**Developer Mode** (top-left button on the login page) allows test login as
-مدیر تدارکات / ادمین / مدیر پروژه without Casdoor. It is controlled by the
-`VITE_ENABLE_DEV_LOGIN` env var (in Docker: the `DEV_LOGIN_ENABLED` compose
-build arg, default `true` — set it to `false` for production builds).
+**Developer Mode** (top-left button on the login page) is a 3-step flow for
+the admin (super user): ① superuser auth gate (admin credentials only) →
+② role switcher (ادمین / مدیر تدارکات / مدیر پروژه + project) → ③ session
+activation by role (admin → **پنل مدیریت ادمین** at `/admin`, مدیر تدارکات →
+procurement office, مدیر پروژه → their project's inventory panel). It is
+controlled by the `VITE_ENABLE_DEV_LOGIN` env var (in Docker: the
+`DEV_LOGIN_ENABLED` compose build arg, default `true` — set it to `false`
+for production builds).
 
 | What | Where | Credentials |
 |---|---|---|
+| App | http://localhost (via Traefik) | — |
 | Casdoor console | http://localhost:8080 | `admin` / `123` |
 | Seeded app users (org `inventory`) | `razaei` (admin), `mousavi` (مدیر تدارکات), `mohaghegh` (مدیر پروژه), `tester` (مدیر پروژه، پروژه «تست») | password `123456` |
 
@@ -132,16 +147,16 @@ All should show `Up` (postgres also `(healthy)`).
 
 | What | Where |
 |---|---|
-| Frontend UI | http://localhost:3000 |
+| Frontend UI | http://localhost |
 | API docs (Swagger) | http://localhost:8000/docs |
 | API health | http://localhost:8000/health → `{"status":"ok","service":"procurement-api"}` |
 | MinIO console | http://localhost:9001 (user/pass `minioadmin`/`minioadmin`) |
-| Database | `localhost:5433`, db `procurement`, user/pass `postgres`/`postgres` |
+| Database | `localhost:5433`, db `procurement`, user/pass `postgres`/`postgres` (Casdoor uses the same instance, db `casdoor`) |
 
-Quick end-to-end check (frontend proxy → API → DB):
+Quick end-to-end check (Traefik → frontend proxy → API → DB):
 
 ```powershell
-curl http://localhost:3000/api/v1/quotes?expand=supplier,project,line_items,termsheets,events,decision,receipt
+curl http://localhost/api/v1/quotes?expand=supplier,project,line_items,termsheets,events,decision,receipt
 ```
 
 ---
@@ -200,7 +215,22 @@ docker compose down -v              # ⚠️ full reset — wipes DB + MinIO vol
   The procurement CRUD endpoints (quotes, suppliers, materials, …) are still
   open — dev placeholder, do not expose to the public internet.
 - Roles live in the app's `users` table (Casdoor is identity-only): `pm`,
-  `procurement_manager`, `admin`. See `docs/casdoor-auth.md`.
+  `procurement_manager`, `admin`. Role changes are **admin-only** (RBAC);
+  the procurement manager can only assign projects to project managers.
+  The admin has a dedicated panel at `/admin` (user sync from Casdoor +
+  grant/revoke «مدیر تدارکات»).
+- **Partial goods receipt** («رسید جزیی») is supported in «کالاهای در راه»:
+  at least one item with a valid quantity is enough to submit; other items
+  stay in transit. The procurement ledger shows «رسیده X از Y» / «در راه Z»
+  badges and a «رسید جزیی» badge on the quote.
+- **One PostgreSQL instance** serves both the app (`procurement`) and Casdoor
+  (`casdoor`) — the separate casdoor-postgres container is gone (data was
+  dumped/restored; see `docs/casdoor-auth.md`).
+- **Traefik v3** is the public edge (ports 80/443); the frontend nginx only
+  serves the SPA and proxies `/api` internally. Production (real domains,
+  HTTPS via Let's Encrypt, HTTP→HTTPS redirect):
+  `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build`
+  (see the prod file header for the required env vars).
 - Schema runs automatically ONLY on the first boot of an empty `postgres_data` volume
   (see `docker-entrypoint-initdb.d`); the API also runs `CREATE TABLE IF NOT EXISTS`
   for the units-dashboard tables and `quote_attachments` at startup.