refactor: route traefik straight to node and drop nginx

[turegjorup]

nginx resolved node once at startup and cached the address for the life of the process. If node returned on a different IP, nginx served 502 permanently while staying healthy itself, so the restart policy never acted. It also overwrote X-Forwarded-For with Traefik's own address and never set X-Forwarded-Proto.

https://leantime.itkdev.dk/#/tickets/showTicket/8293

It proxied and nothing else: no static files, no caching, no auth.

Changes

• docker-compose.yml and docker-compose.server.yml: nginx service removed, Traefik labels moved to node, which joins the frontend network.
• An explicit loadbalancer.server.port=3000 label — the node image has no EXPOSE, so Traefik cannot detect the port.
• docker-compose.dev.yml: ITKBasicAuth@file moved to the node router, so staging keeps its password.
• docker-compose.redirect.yml: www redirect labels moved likewise.
• .docker/vhost.conf deleted.
• app.js: trust proxy set, so Express believes the headers Traefik sets.
• test.js and README.md: reach the app on node:3000 instead of through nginx.

Verify

cp config.dev.js.dist config.js
docker compose run --rm node yarn install
docker compose --profile db up --detach
docker compose run --rm node node .docker/mssql/seed.js
docker compose run --rm node node test.js
docker compose ps

Expected: 11/11 passed, and only node and mssql running.

Deploy

Deploy this one with --remove-orphans. Without it up --detach leaves the old nginx container running, with Traefik labels for the same router names and a stale upstream IP once node is recreated:

docker compose --env-file .env.docker.local --file docker-compose.server.yml up --detach --remove-orphans

Before deploying:

• node now joins the shared frontend network, where the service name node becomes a DNS alias. Run docker network inspect frontend on the server and check that no other project has a node service there. If one does, the service needs a unique name.
• docker-compose.dev.yml and docker-compose.redirect.yml are shared ITK templates (# itk-version:). The label move needs coordinating with the team so the next template update does not put nginx back.
• The unversioned scripts/test on the server curls / through nginx. If it addresses nginx by name it breaks with this PR, until build: add taskfile #28 replaces it.

On the server, confirm after deploy that https://<host>/ answers and lists both routes, that /posidryeartsl.csv returns 200, and that docker compose ps shows no nginx container.

Stacked on #22.