Review completed with approve. The clean, single-commit change correctly makes hardened Caddy the default TLS frontend while preserving loopback-only app access. Documentation, Dependabot configuration, Caddy timeouts, Compose dependencies, ports, capabilities, and tests are consistent. No blocking correctness or security issues found.