feat(V2): integrazione Traefik con TLS + watchtower, rimosso port mapping diretto

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -3,8 +3,6 @@ services:
     image: cerbero-mcp:2.0.0
     build: .
     container_name: cerbero-mcp
-    ports:
-      - "${PORT:-9000}:${PORT:-9000}"
     env_file: .env
     restart: unless-stopped
     healthcheck:
@@ -16,3 +14,18 @@ services:
       interval: 30s
       timeout: 5s
       retries: 3
+    networks:
+      - traefik
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik
+      - "traefik.http.routers.cerbero-mcp.rule=Host(`cerbero-mcp.${DOMAIN_NAME:-tielogic.xyz}`)"
+      - traefik.http.routers.cerbero-mcp.tls=true
+      - traefik.http.routers.cerbero-mcp.entrypoints=websecure
+      - traefik.http.routers.cerbero-mcp.tls.certresolver=mytlschallenge
+      - "traefik.http.services.cerbero-mcp.loadbalancer.server.port=${PORT:-9000}"
+      - "com.centurylinklabs.watchtower.enable=true"
+
+networks:
+  traefik:
+    external: true