Add deployment phase and Traefik compose override

Insert a new Phase 1 (deployment: Compose + Traefik on a server, marked
Done) between the base project and the OTel concepts phase, and shift
the old phases 1-10 to 2-11. Update summary, intro, README and CLAUDE.md
references (spoiler rules now target Phase 9, the bottleneck hunt).

Add docker-compose.traefik.yml: an override that fronts the gateway with
Traefik and Let's Encrypt and removes all other published host ports.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker-compose.traefik.yml

@@ -0,0 +1,63 @@
+# Production-style override: put the gateway (frontend + API) behind Traefik
+# with automatic Let's Encrypt TLS. Use together with the base file:
+#
+#   docker compose -f docker-compose.yml -f docker-compose.traefik.yml up -d --build
+#
+# Only Traefik publishes host ports (80/443). Everything else is reachable
+# only on the compose network.
+
+services:
+  traefik:
+    image: traefik:v3.6
+    restart: unless-stopped
+    command:
+      - --providers.docker=true
+      - --providers.docker.exposedByDefault=false
+      - --entrypoints.web.address=:80
+      - --entrypoints.web.http.redirections.entryPoint.to=websecure
+      - --entrypoints.web.http.redirections.entryPoint.scheme=https
+      - --entrypoints.websecure.address=:443
+      - --certificatesresolvers.le.acme.httpchallenge=true
+      - --certificatesresolvers.le.acme.httpchallenge.entrypoint=web
+      - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
+      - --log.level=INFO
+      - --accesslog=true
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - letsencrypt:/letsencrypt
+
+  gateway:
+    ports: !reset []
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.ledgerline.rule=Host(`ledgerline.vione.cloud`)
+      - traefik.http.routers.ledgerline.entrypoints=websecure
+      - traefik.http.routers.ledgerline.tls.certresolver=le
+      - traefik.http.services.ledgerline.loadbalancer.server.port=8000
+
+  postgres:
+    ports: !reset []
+
+  redis:
+    ports: !reset []
+
+  ledger:
+    ports: !reset []
+
+  fraud:
+    ports: !reset []
+
+  sanctions:
+    ports: !reset []
+
+  insights:
+    ports: !reset []
+
+  notifier:
+    ports: !reset []
+
+volumes:
+  letsencrypt: