infra: single postgres instance (casdoor DB merged) + Traefik v3 edge

- remove the separate casdoor-postgres container; casdoor uses the main
  postgres (db casdoor, created by sql/02-casdoor-db.sql on fresh volumes);
  data migrated via pg_dump/pg_restore (backups kept outside the repo)
- Traefik v3.6 as the public edge (ports 80/443): docker provider pinned to
  the dedicated traefik_network (fixed-name network), host rules for
  app/api/auth/s3/storage (env-overridable, localhost defaults), frontend
  nginx demoted to internal SPA server; docker-compose.prod.yml adds real
  domains + Let's Encrypt + HTTP→HTTPS redirect (redirect middleware in
  infra/traefik-dynamic.yml)
- v3.6 required (Traefik <=3.3 fails against Docker Engine 29.x); socket
  mounted rw (Docker Desktop rejects :ro)
- start.ps1: app URL now http://localhost, casdoor + db notes

docker-compose.yml

@@ -14,7 +14,7 @@ services:
     volumes:
       - postgres_data:/var/lib/postgresql
       - ./sql/migration.sql:/docker-entrypoint-initdb.d/01-migration.sql:ro
-      # - ./sql/seed.sql:/docker-entrypoint-initdb.d/02-seed.sql:ro
+      - ./sql/02-casdoor-db.sql:/docker-entrypoint-initdb.d/02-casdoor-db.sql:ro
 
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U postgres -d procurement"]
@@ -24,6 +24,44 @@ services:
 
     restart: unless-stopped
 
+  # ==========================================================================
+  # Traefik v3 — public reverse proxy (replaces nginx as the edge)
+  # App is served on http://localhost (port 80) instead of :3000.
+  # Production: see docker-compose.prod.yml (real domains + HTTPS via
+  # Let's Encrypt, HTTP→HTTPS redirect).
+  # ==========================================================================
+  traefik:
+    # v3.6+ required: Traefik ≤3.3 fails against Docker Engine 29.x
+    # ("Error response from daemon" — Docker API version mismatch).
+    image: traefik:v3.6
+    container_name: procurement-traefik
+    restart: unless-stopped
+    command:
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      # Containers are on several networks; Traefik must use the dedicated
+      # proxy network IP (otherwise it may pick the default-network IP → 504).
+      - --providers.docker.network=traefik_network
+      - --providers.file.filename=/etc/traefik/dynamic.yml
+      - --entrypoints.web.address=:80
+      - --entrypoints.websecure.address=:443
+      - --certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL:-admin@example.com}
+      - --certificatesresolvers.letsencrypt.acme.storage=/certs/acme.json
+      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
+      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
+      - --log.level=INFO
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      # NOTE: mounted read-write — Docker Desktop rejects read-only
+      # /var/run/docker.sock mounts ("Error response from daemon").
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./infra/traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
+      - traefik_certs:/certs
+    networks:
+      - traefik_network
+
   minio:
     image: minio/minio:latest
     container_name: procurement-minio
@@ -41,6 +79,23 @@ services:
     volumes:
       - minio_data:/data
 
+    labels:
+      - traefik.enable=true
+      # S3 API
+      - traefik.http.routers.minio-api.rule=Host(`${S3_HOST:-s3.localhost}`)
+      - traefik.http.routers.minio-api.entrypoints=web
+      - traefik.http.routers.minio-api.service=minio-api-svc
+      - traefik.http.services.minio-api-svc.loadbalancer.server.port=9000
+      # Web console
+      - traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:-storage.localhost}`)
+      - traefik.http.routers.minio-console.entrypoints=web
+      - traefik.http.routers.minio-console.service=minio-console-svc
+      - traefik.http.services.minio-console-svc.loadbalancer.server.port=9001
+
+    networks:
+      - traefik_network
+      - default
+
     restart: unless-stopped
 
   # MinIO Client (mc): waits for the server, creates the bucket, exits.
@@ -77,31 +132,35 @@ services:
   # is created by backend/tools/seed_casdoor.py — run it once after the
   # first boot:
   #   docker compose run --rm -e CASDOOR_BASE=http://casdoor:8000 api python tools/seed_casdoor.py
+  #
+  # Casdoor uses the SAME postgres instance as the app (database `casdoor`,
+  # created by sql/02-casdoor-db.sql on a fresh volume).
   # ==========================================================================
-  casdoor-postgres:
-    image: postgres:16
-    container_name: procurement-casdoor-postgres
-    environment:
-      POSTGRES_DB: casdoor
-      POSTGRES_USER: casdoor
-      POSTGRES_PASSWORD: casdoor
-    volumes:
-      - casdoor_postgres_data:/var/lib/postgresql
-    restart: unless-stopped
-
   casdoor:
     image: casbin/casdoor:latest
     container_name: procurement-casdoor
     depends_on:
-      - casdoor-postgres
+      postgres:
+        condition: service_healthy
     environment:
       RUNNING_IN_DOCKER: "true"
       driverName: postgres
-      dataSourceName: "user=casdoor password=casdoor host=casdoor-postgres port=5432 sslmode=disable dbname=casdoor"
+      dataSourceName: "user=casdoor password=casdoor host=postgres port=5432 sslmode=disable dbname=casdoor"
       dbName: casdoor
       origin: "http://localhost:8080"
     ports:
       - "8080:8000"
+
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.casdoor.rule=Host(`${AUTH_HOST:-auth.localhost}`)
+      - traefik.http.routers.casdoor.entrypoints=web
+      - traefik.http.services.casdoor.loadbalancer.server.port=8000
+
+    networks:
+      - traefik_network
+      - default
+
     restart: unless-stopped
 
   api:
@@ -126,10 +185,23 @@ services:
       PROCUREMENT_CASDOOR_ORGANIZATION: inventory
       PROCUREMENT_CASDOOR_APP_NAME: inventory-app
       PROCUREMENT_CASDOOR_AUDIENCE: inventory-app-client
+      # Console admin used by POST /users/sync (identity mirroring).
+      PROCUREMENT_CASDOOR_ADMIN_USER: admin
+      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: "123"
 
     ports:
       - "8000:8000"
 
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.api.rule=Host(`${API_HOST:-api.localhost}`)
+      - traefik.http.routers.api.entrypoints=web
+      - traefik.http.services.api.loadbalancer.server.port=8000
+
+    networks:
+      - traefik_network
+      - default
+
     depends_on:
       postgres:
         condition: service_healthy
@@ -146,15 +218,29 @@ services:
         DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-true}
     container_name: procurement-frontend
 
-    ports:
-      - "3000:80"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.frontend.rule=Host(`${APP_HOST:-localhost}`)
+      - traefik.http.routers.frontend.entrypoints=web
+      - traefik.http.services.frontend.loadbalancer.server.port=80
+
+    networks:
+      - traefik_network
+      - default
 
     depends_on:
       - api
 
     restart: unless-stopped
 
+networks:
+  # شبکه‌ی عمومی: فقط ترافیک و سرویس‌های عمومی. postgres روی شبکه‌ی
+  # پیش‌فرض می‌ماند و از بیرون قابل دسترسی نیست.
+  traefik_network:
+    name: traefik_network
+    driver: bridge
+
 volumes:
   postgres_data:
   minio_data:
-  casdoor_postgres_data:
+  traefik_certs: