feat: add Traefik labels for worship.hesed.sbs via homelab Dokploy

- Join dokploy-network so homelab Traefik can discover the container
- Remove host port binding (Traefik routes directly via service discovery)
- Add HTTP→HTTPS redirect and HTTPS router with letsencrypt cert
- VPS Traefik passthrough for worship.hesed.sbs already added on server

docker-compose.yml

@@ -2,8 +2,6 @@ services:
   ytplayer:
     build: .
     restart: unless-stopped
-    ports:
-      - "${PORT:-3000}:3000"
     volumes:
       # libsql DB file persists across container rebuilds
       - ytplayer-data:/app/data
@@ -19,7 +17,22 @@ services:
       timeout: 5s
       retries: 3
       start_period: 15s
+    networks:
+      - dokploy-network
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.ytplayer-http.rule=Host(`worship.hesed.sbs`)"
+      - "traefik.http.routers.ytplayer-http.entrypoints=web"
+      - "traefik.http.routers.ytplayer-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.ytplayer-https.rule=Host(`worship.hesed.sbs`)"
+      - "traefik.http.routers.ytplayer-https.entrypoints=websecure"
+      - "traefik.http.routers.ytplayer-https.tls.certresolver=letsencrypt"
+      - "traefik.http.services.ytplayer-svc.loadbalancer.server.port=3000"
 
 volumes:
   ytplayer-data:
     driver: local
+
+networks:
+  dokploy-network:
+    external: true