Unix socket volume was root-owned, FPM running as uid 1000 couldn't
create the socket. TCP app:9000 works without privilege changes and
has negligible performance difference in a local Docker network.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces TCP app:9000 with a shared Unix socket volume, adds domain
with automatic Let's Encrypt TLS, and exposes ports 80/443 on Caddy.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>