Host on AWS Lightsail as boards.watersmedia.org

Replace the planned Synology deploy with one Lightsail box: Caddy in front of the
app for automatic HTTPS (deploy/aws/docker-compose.yml, Caddyfile), a deploy
script that rsyncs server/ and rebuilds in place without touching data/ or .env,
and a Gitea workflow that runs the same script from the nas runner over SSH.
README documents the box, DNS, .env, deploys and restore. Allow both church
Google Workspace domains to sign in. Drop the NAS-only compose file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/aws/Caddyfile

@@ -0,0 +1,20 @@
+# Caddy in front of Waters Boards.
+#
+# Caddy gets and renews the Let's Encrypt certificate by itself. That only works while
+# the DNS A record for boards.watersmedia.org points at this box and ports 80 and 443
+# are open in the Lightsail firewall.
+
+{
+	# Let's Encrypt sends certificate expiry notices here.
+	email michael@waterschurch.org
+}
+
+boards.watersmedia.org {
+	encode zstd gzip
+
+	reverse_proxy boards:3100 {
+		# Required: send every write straight through. Without it Caddy can buffer the
+		# server-sent events stream at /api/events and live updates stop arriving.
+		flush_interval -1
+	}
+}