chore: prod compose 同步 TLS/Caddy + gitea 域名（回流服务器本地改动）

服务器 8-09 直接手改的 TLS/Caddy 改动从未提交 gitea，git-ify checkout
会覆盖丢失 HTTPS。回流 3 处差异：
- frontend 宿主端口 80:80 → 127.0.0.1:8080:80（8080 收紧）
- gitea 域名 123.207.9.209 → gitea.oncolit.gonsun.com
- 新增 caddy 服务（80/443 + Caddyfile 卷）+ caddy_data/caddy_config 卷
Caddyfile 加入仓库根；docs/16 记 v17 回流规则。

docker-compose.prod.yml

@@ -246,7 +246,7 @@ services:
     environment:
       VITE_API_BASE: /api/v1
     ports:
-      - "80:80"
+      - "127.0.0.1:8080:80"
     volumes:
       - /var/log/scilit/nginx:/var/log/nginx
     depends_on:
@@ -272,18 +272,39 @@ services:
       GITEA__database__NAME: gitea
       GITEA__database__USER: gitea
       GITEA__database__PASSWD: gitea_pass_2026
-      GITEA__server__DOMAIN: 123.207.9.209
+      GITEA__server__DOMAIN: gitea.oncolit.gonsun.com
       GITEA__server__HTTP_PORT: 3000
-      GITEA__server__ROOT_URL: http://123.207.9.209:3000
-      GITEA__server__START_SSH_SERVER: "true"
-      GITEA__server__SSH_DOMAIN: 123.207.9.209
+      GITEA__server__ROOT_URL: https://gitea.oncolit.gonsun.com/
+      GITEA__server__START_SSH_SERVER: true
+      GITEA__server__SSH_DOMAIN: gitea.oncolit.gonsun.com
       GITEA__server__SSH_PORT: 2222
       GITEA__server__SSH_LISTEN_PORT: 22
     ports:
-      - "3000:3000"
-      - "2222:22"
+      - 3000:3000
+      - 2222:22
+
+
+  caddy:
+    image: caddy:2-alpine
+    networks:
+      - scilit
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
 
 volumes:
+  caddy_data:
+  caddy_config:
   pgdata:
   redisdata:
   esdata: