fix: map Docker nginx to port 8080 to avoid conflict with host reverse proxy

The base docker-compose.yml maps nginx to 80:80, which conflicts with
the host-level nginx that handles SSL termination on production servers.
The production overlay now explicitly maps to 8080:80 so the host proxy
can forward to localhost:8080. Updated DEPLOYMENT.md with host reverse
proxy setup instructions and corrected architecture diagrams.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -10,10 +10,13 @@
 #   - Restart policies for reliability
 #
 # SSL/TLS is handled at the host level (e.g., host nginx + certbot).
-# The Docker nginx container listens on port 80 only.
+# The Docker nginx container listens internally on port 80, mapped to
+# host port 8080 so it doesn't conflict with the host reverse proxy.
 
 services:
   nginx:
+    ports:
+      - "8080:80"                          # override: avoid conflict with host nginx
     volumes:
       - ./nginx/production.conf:/etc/nginx/conf.d/default.conf:ro
     restart: unless-stopped