deploy: add prod compose overlay (no host port, joins intranet network)

The VPS deployment sits behind Nginx Proxy Manager on a pre-existing
`intranet` Docker bridge network. The overlay drops the host port
binding from the base compose, switches uvicorn to listen on port 80
inside the container (uniform NPM upstreams), and joins the app to
both `default` (for db/redis) and `intranet` (for NPM ingress).

Apply with:
  docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d

Local dev (compose without the overlay) is unchanged — still binds
the host port from CASSANDRA_PORT in .env.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -16,6 +16,17 @@ docker compose up --build  # db + app + scheduler + daily backup sidecar
 open http://localhost:8000/
 ```
 
+## Production (VPS)
+
+Apply the prod overlay so the app has no host port binding and joins the
+existing `intranet` Docker network (where Nginx Proxy Manager lives):
+
+```bash
+docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
+```
+
+Then point NPM at upstream `readmarkets-app-1:80`.
+
 ## Architecture
 
 - **app** (FastAPI + Jinja2 + HTMX) — web dashboard on port 8000