infra: single postgres instance (casdoor DB merged) + Traefik v3 edge

- remove the separate casdoor-postgres container; casdoor uses the main
  postgres (db casdoor, created by sql/02-casdoor-db.sql on fresh volumes);
  data migrated via pg_dump/pg_restore (backups kept outside the repo)
- Traefik v3.6 as the public edge (ports 80/443): docker provider pinned to
  the dedicated traefik_network (fixed-name network), host rules for
  app/api/auth/s3/storage (env-overridable, localhost defaults), frontend
  nginx demoted to internal SPA server; docker-compose.prod.yml adds real
  domains + Let's Encrypt + HTTP→HTTPS redirect (redirect middleware in
  infra/traefik-dynamic.yml)
- v3.6 required (Traefik <=3.3 fails against Docker Engine 29.x); socket
  mounted rw (Docker Desktop rejects :ro)
- start.ps1: app URL now http://localhost, casdoor + db notes

sql/02-casdoor-db.sql

@@ -0,0 +1,9 @@
+-- ============================================================
+-- 02-casdoor-db.sql — creates the Casdoor role + database on the
+-- unified PostgreSQL instance (runs only on a fresh postgres volume,
+-- after 01-migration.sql). The Casdoor service connects here instead
+-- of running its own postgres container (v1.3 DB consolidation).
+-- ============================================================
+
+CREATE ROLE casdoor LOGIN PASSWORD 'casdoor';
+CREATE DATABASE casdoor OWNER casdoor;