compose: Traefik label-based auto-discovery

Add Traefik labels so the Docker provider auto-discovers the app.
Includes traefik.docker.network (the app is on two networks) which is
the usual fix for routing not resolving. Host/entrypoint/certresolver
overridable via PRINTHIVE_HOST / TRAEFIK_ENTRYPOINT / TRAEFIK_CERTRESOLVER.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -35,19 +35,19 @@ services:
       - uploads:/app/uploads
       - thumbnails:/app/thumbnails
       - glb:/app/glb
-    # No host port published — Traefik reaches the app over the shared network
-    # at http://printhive-app:3000 (configure that in your Traefik file provider).
+    # No host port published — Traefik auto-discovers the app on the shared network.
     networks:
       - default     # talk to the db
       - traefik     # reachable by Traefik
     restart: unless-stopped
-    # Traefik (if using labels rather than your file provider):
-    # labels:
-    #   - "traefik.enable=true"
-    #   - "traefik.http.routers.printhive.rule=Host(`printhive.plexultra.com`)"
-    #   - "traefik.http.routers.printhive.entrypoints=websecure"
-    #   - "traefik.http.routers.printhive.tls.certresolver=letsencrypt"
-    #   - "traefik.http.services.printhive.loadbalancer.server.port=3000"
+    labels:
+      - "traefik.enable=true"
+      # App is on two networks; tell Traefik which one to reach it on.
+      - "traefik.docker.network=${TRAEFIK_NETWORK:-traefik}"
+      - "traefik.http.routers.printhive.rule=Host(`${PRINTHIVE_HOST:-printhive.plexultra.com}`)"
+      - "traefik.http.routers.printhive.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
+      - "traefik.http.routers.printhive.tls.certresolver=${TRAEFIK_CERTRESOLVER:-letsencrypt}"
+      - "traefik.http.services.printhive.loadbalancer.server.port=3000"
 
 volumes:
   pgdata: