deploy: split compose into base (prod-ready) + dev override

Compose merges list-typed fields like \`ports\` by concatenation, so the
previous prod overlay couldn't clear the base file's host port binding;
the VPS app ended up listening on both port 80 (intranet) AND host port
8800 simultaneously.

Restructured to the conventional dev/prod split:
- docker-compose.yml: no host port — prod-ready by default
- docker-compose.override.yml: dev-only host port binding (auto-loaded
  by \`docker compose up\` locally, skipped when prod uses explicit -f)
- docker-compose.prod.yml: command-port 80 + intranet network only

Production invocation:
  docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -8,24 +8,28 @@ Production:
 
 The Python package is still named `cassandra` and several internal identifiers (cookie names, advisory-lock keys, `CASSANDRA_TOKEN` env var, CSS filename) keep the legacy name on purpose — renaming them would invalidate live sessions / locks / configs for no user benefit. See `app/branding.py` for the brand single-source-of-truth.
 
-## Quick start
+## Quick start (local dev)
 
 ```bash
 cp .env.example .env       # fill in API keys; set CASSANDRA_TOKEN if exposing
 docker compose up --build  # db + app + scheduler + daily backup sidecar
-open http://localhost:8000/
+open http://localhost:8000/  # or whichever CASSANDRA_PORT you set
 ```
 
-## Production (VPS)
+`docker-compose.override.yml` is auto-loaded and adds the host port
+binding so the app is reachable on `localhost`.
 
-Apply the prod overlay so the app has no host port binding and joins the
-existing `intranet` Docker network (where Nginx Proxy Manager lives):
+## Production (VPS, NPM-fronted)
+
+Always invoke with **explicit -f flags** — that way the dev override is
+skipped and the prod overlay (no host port, joins the external
+`intranet` Docker network, uvicorn on port 80) is applied:
 
 ```bash
 docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
 ```
 
-Then point NPM at upstream `readmarkets-app-1:80`.
+Point Nginx Proxy Manager at upstream `readmarkets-app-1:80`.
 
 ## Architecture