[codex] Set up Caddy HTTPS deployment

[jjoonleo]

Summary

• add a Caddy reverse proxy config for ontime-back.duckdns.org
• update the production deploy workflow to upload/install/configure Caddy and verify HTTPS
• bind the backend container to 127.0.0.1:8080 so public traffic goes through HTTPS
• update deployment docs and Apple callback domain for DuckDNS

Validation

• workflow and compose YAML parsed successfully
• embedded deploy shell passes bash -n
• compose port binding resolves to 127.0.0.1:8080
• ./gradlew test

Deployment Notes

• EC2 security group must allow inbound TCP 80 and 443
• GitHub secret BACKEND_HTTP_PORT must be removed or set to 127.0.0.1:8080
• ontime-back.duckdns.org resolves to 3.36.80.94