Stop publishing ports 3000/6080 to the host

On Dokploy, traffic is routed through Traefik via the configured
domain — publishing host ports caused a collision with another
service already bound to 3000 on the same host. Switch to `expose`
so the ports are reachable on the internal Docker network only.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -11,9 +11,11 @@ services:
     # Mount the data directory to persist the database and browser session
     volumes:
       - ./data:/app/data
-    ports:
+    # Ports are NOT published to the host. Dokploy/Traefik routes traffic
-      - "3000:3000"   # Web dashboard
+    # to the container's internal ports via configured domains.
-      - "6080:6080"   # noVNC for human login
+    expose:
+      - "3000"   # Web dashboard
+      - "6080"   # noVNC for human login
     environment:
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
       - REDDIT_USERNAME=${REDDIT_USERNAME}