Host on AWS Lightsail as boards.watersmedia.org

Replace the planned Synology deploy with one Lightsail box: Caddy in front of the
app for automatic HTTPS (deploy/aws/docker-compose.yml, Caddyfile), a deploy
script that rsyncs server/ and rebuilds in place without touching data/ or .env,
and a Gitea workflow that runs the same script from the nas runner over SSH.
README documents the box, DNS, .env, deploys and restore. Allow both church
Google Workspace domains to sign in. Drop the NAS-only compose file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/aws/docker-compose.yml

@@ -0,0 +1,45 @@
+# Waters Boards on the AWS Lightsail box.
+#
+# This file is copied to /opt/waters-boards/ on the box (deploy/aws/deploy.sh does it), and
+# sits there next to:
+#   .env         secrets, created by hand once, never overwritten by a deploy
+#   data/        database, uploads and nightly backups, never touched by a deploy
+#   Caddyfile    the reverse-proxy config from this folder
+#   server/      the app source, rsynced from ../../server
+# "build: ./server" and "./data" below are relative to that folder, not to this repo.
+
+services:
+  boards:
+    build: ./server
+    image: waters-boards:latest
+    container_name: waters-boards
+    restart: unless-stopped
+    env_file:
+      - ./.env
+    volumes:
+      # Database (boards.db), uploaded files and nightly backups.
+      - ./data:/app/data
+    # Reachable only from Caddy on the compose network. No "ports": the app is never public.
+    expose:
+      - "3100"
+
+  caddy:
+    image: caddy:2.10-alpine
+    container_name: waters-caddy
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "443:443/udp"   # HTTP/3
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      # Certificates and Caddy's state. Keep these volumes, or Caddy has to re-issue the
+      # certificate on every restart and Let's Encrypt will rate-limit it.
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      - boards
+
+volumes:
+  caddy_data:
+  caddy_config: