Avoid host port clashes with Ahmed's app by exposing prod web on 81 and the local API on 8001.

Co-authored-by: Cursor <cursoragent@cursor.com>

ar-aging-app/docker-compose.prod.yml

@@ -1,4 +1,4 @@
-# Production stack: caddy (auto-HTTPS) -> web (nginx: SPA + /api proxy) -> backend + mysql.
+# Production stack: [your reverse proxy] -> web (nginx: SPA + /api proxy) -> backend + mysql.
 #
 #   cp .env.example .env.production   # fill the PRODUCTION section first
 #   docker compose --env-file .env.production -f docker-compose.prod.yml up -d --build
@@ -6,6 +6,15 @@
 # --env-file is REQUIRED: the ${AR_DOMAIN} / ${MYSQL_ROOT_PASSWORD} references below are
 # resolved from it (env_file: alone only feeds the containers, not this YAML).
 #
+# SHARED SERVER (default): the app's only host port is 127.0.0.1:81 (the web UI). Point
+# the server's reverse proxy for ar.utopiabrands.com at http://127.0.0.1:81 with
+#   client_max_body_size 2g; proxy_read_timeout 600s; proxy_request_buffering off;
+# All other ports (backend 8000, mysql 3306) are container-internal and can never
+# conflict with other apps on the box.
+#
+# DEDICATED SERVER: nothing else on 80/443? Start the bundled auto-HTTPS front instead:
+#   docker compose --env-file .env.production -f docker-compose.prod.yml --profile caddy up -d --build
+#
 # Sized for one 8 GB server (300-500 MB Excel parsing needs the RAM). Backend runs ONE
 # worker by design — jobs and their progress live in-process. See deploy/DEPLOY.md.
 
@@ -55,13 +64,17 @@ services:
     restart: unless-stopped
     depends_on:
       - backend
-    # Not exposed directly — caddy fronts it with TLS.
+    ports:
+      # Loopback-only: reachable by the server's own reverse proxy, never the internet.
+      # Host port 81 avoids clashing with anything else on a shared box.
+      - "127.0.0.1:81:80"
 
-  # TLS terminator: automatic Let's Encrypt certificates for AR_DOMAIN, renewed by itself.
-  # No certbot cron, no cert plumbing. Set AR_DOMAIN (and a DNS A record) and it works.
+  # OPTIONAL auto-HTTPS front for a DEDICATED server (--profile caddy). Not started by
+  # default: on a shared box another proxy usually owns 80/443 already.
   caddy:
     image: caddy:2-alpine
     restart: unless-stopped
+    profiles: ["caddy"]
     ports:
       - "80:80"
       - "443:443"

ar-aging-app/docker-compose.yml

@@ -5,7 +5,8 @@ services:
     environment:
       AR_DATA_DIR: /data
     ports:
-      - "8000:8000"
+      # Host 8001 avoids clashing with Ahmed's app on 8000.
+      - "8001:8000"
     volumes:
       - ./backend:/app
       - ar_data:/data