refactor: all-in-one docker deployment with auto-tuned resources and per-mode compose templates

.docker/caddy/Caddyfile

@@ -0,0 +1,26 @@
+# Xboard protocol fusion entrypoint.
+#
+# Caddy listens on a single public port and dispatches HTTP traffic to Octane
+# while transparently upgrading WebSocket requests to the ws-server worker.
+# This lets every external reverse proxy (nginx, Cloudflare, the user's own
+# Caddy, ...) treat the panel as a single upstream and avoids exposing the
+# 8076 WebSocket port directly.
+{
+	admin off
+	auto_https off
+	persist_config off
+	log {
+		output stdout
+		format console
+	}
+}
+
+:{$CADDY_LISTEN_PORT:7001} {
+	@ws path /ws
+	reverse_proxy @ws 127.0.0.1:{$WS_PORT:8076}
+
+	reverse_proxy 127.0.0.1:{$OCTANE_INTERNAL_PORT:7002} {
+		header_up Host {host}
+		header_up X-Real-IP {remote_host}
+	}
+}

.docker/caddy/Caddyfile.split

@@ -0,0 +1,22 @@
+# Caddy config used by compose.split.yaml — the embedded image's Caddy is
+# disabled in this mode and a dedicated Caddy container fronts independent
+# web and ws-server containers reachable via the compose network.
+{
+	admin off
+	auto_https off
+	persist_config off
+	log {
+		output stdout
+		format console
+	}
+}
+
+:7001 {
+	@ws path /ws
+	reverse_proxy @ws ws-server:8076
+
+	reverse_proxy web:7001 {
+		header_up Host {host}
+		header_up X-Real-IP {remote_host}
+	}
+}