Publish noVNC on host:16080 to bypass WS-stripping reverse proxy

The upstream openresty proxy in front of Dokploy strips the
WebSocket Upgrade header, which kills noVNC. Publishing noVNC
directly on a host port (16080) avoids the proxy entirely.
Auth is still gated by VNC_PASSWORD. The dashboard continues
to go through Traefik on its existing domain.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -15,11 +15,14 @@ services:
     # path on every restart.
     volumes:
       - reddit_bot_data:/app/data
-    # Ports are NOT published to the host. Dokploy/Traefik routes traffic
+    # Dashboard goes through Traefik on a domain; noVNC needs the WebSocket
-    # to the container's internal ports via configured domains.
+    # upgrade header, which the upstream openresty proxy strips, so we
+    # publish noVNC directly on a host port and access it via the dokploy
+    # host's IP. Auth is handled by VNC_PASSWORD.
+    ports:
+      - "16080:6080"   # noVNC, reachable as http://<dokploy-host>:16080/
     expose:
-      - "3000"   # Web dashboard
+      - "3000"         # Web dashboard (Traefik-routed)
-      - "6080"   # noVNC for human login
     environment:
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
       - REDDIT_USERNAME=${REDDIT_USERNAME}