Add Caddy for automatic HTTPS in front of the frontend/backend stack

Caddy now owns ports 80/443 and reverse-proxies to the frontend
container (which was publishing 80 itself, conflicting with Caddy),
handling Let's Encrypt certificate issuance/renewal automatically.
Fix the Caddyfile's upstream name (it referenced a nonexistent "app"
service instead of "frontend") and update the Lightsail deploy guide's
HTTPS section to match this setup instead of the old manual-certbot
approach.

Caddyfile

@@ -0,0 +1,3 @@
+colcaroli-playchat.duckdns.org {
+    reverse_proxy frontend:80
+}