feat: all-in-one production deployment with install script

Redesign deployment as a single docker-compose with Backspace, Caddy
(auto-HTTPS), and LiveKit (voice/video) using hybrid networking:
Backspace+Caddy on isolated bridge, LiveKit on host mode for WebRTC.

- Add install.sh: interactive installer that handles Docker setup,
  domain/DNS verification, secret generation, LiveKit config, and
  deployment with health-check wait
- Add Caddyfile: static reverse proxy config using Caddy env vars,
  routes /livekit/* to host-mode LiveKit via host.docker.internal
- Rewrite docker-compose.yml: all-in-one with profiles (voice),
  no external volumes/networks, bind mount ./data for visibility
- Fix livekit.ts: use LIVEKIT_URL env var directly instead of
  Host-header derivation that made the env var dead code
- Fix Dockerfile: health check reads $PORT dynamically
- Update .env.example: add DOMAIN, COMPOSE_PROFILES documentation
- Update .gitignore: add livekit.yaml (contains secrets)

docker-compose.yml

@@ -1,12 +1,20 @@
+# ============================================================
+# Backspace — All-in-one production deployment
+# ============================================================
+# Run ./install.sh for first-time setup, or configure manually:
+#   1. Copy .env.example to .env and fill in values
+#   2. Generate livekit.yaml (if enabling voice)
+#   3. docker compose up -d --build
+# ============================================================
+
 services:
+  # ── Backspace application server ──────────────────────────
   backspace:
     build: .
     container_name: backspace
     restart: unless-stopped
-    ports:
-      - "${PORT:-3000}:${PORT:-3000}"
     volumes:
-      - backspace-data:/app/data
+      - ./data:/app/data
     env_file:
       - .env
     environment:
@@ -14,20 +22,53 @@ services:
       - DB_PATH=/app/data/backspace.db
       - UPLOAD_DIR=/app/data/uploads
     networks:
-      - backspace-net
+      - internal
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://localhost:${PORT:-3000}/api/health').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))"]
+      test: ["CMD", "node", "-e", "fetch('http://localhost:' + (process.env.PORT || 3000) + '/api/health').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))"]
       interval: 30s
       timeout: 5s
-      retries: 3
-      start_period: 10s
+      retries: 5
+      start_period: 30s
 
-volumes:
-  backspace-data:
-    name: backspace-data
-    external: true
+  # ── Caddy reverse proxy (auto-HTTPS) ─────────────────────
+  caddy:
+    image: caddy:2-alpine
+    container_name: caddy
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      - DOMAIN=${DOMAIN:?Set DOMAIN in .env}
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+      - caddy-config:/config
+    networks:
+      - internal
+    depends_on:
+      backspace:
+        condition: service_healthy
+
+  # ── LiveKit voice/video server ────────────────────────────
+  # Activated by COMPOSE_PROFILES=voice in .env
+  livekit:
+    image: livekit/livekit-server:latest
+    container_name: livekit
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - ./livekit.yaml:/etc/livekit.yaml:ro
+    command: --config /etc/livekit.yaml
+    profiles:
+      - voice
 
 networks:
-  backspace-net:
-    name: backspace-net
-    external: true
+  internal:
+    driver: bridge
+
+volumes:
+  caddy-data:
+  caddy-config: