feat: public access via reverse proxy + 'The Ledger' UI design pass

- compose publishes 8787 on all interfaces (NPM fronts it at
  bountyboard.anypreta.com); APP_BASE_URL + TRUSTED_PROXY_CIDRS configured,
  client-IP resolution through the proxy verified live
- design: self-hosted variable fonts (Fraunces display serif, Schibsted
  Grotesk UI, Spline Sans Mono ledger numerals), paper-grain overlay,
  hairline double rules, letterpress buttons, stamped badges, banknote
  bounty chips, ledger tables, staggered page reveal (reduced-motion safe)
- §10 tokens, 2px radius, both themes, AA contrast preserved exactly;
  no build step, CSP-clean (fonts/img self/data)
- login/register masthead; headless-chrome screenshots verified both themes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -30,8 +30,13 @@ services:
       # in-network address handed to the external services for callbacks
       # and signed attachment URLs (§5.2 example: http://app:8787/…)
       APP_INTERNAL_URL: http://app:8787
+    # NOTE: published on all interfaces to match this host's pattern (gitea,
+    # outline, wekan are exposed the same way; docker-published ports bypass
+    # UFW). The spec-default loopback-only binding is the commented line —
+    # restore it once the app sits behind the reverse proxy exclusively.
     ports:
-      - "127.0.0.1:${APP_PORT:-8787}:8787"
+      - "${APP_PORT:-8787}:8787"
+      # - "127.0.0.1:${APP_PORT:-8787}:8787"
     depends_on:
       mongo:
         condition: service_healthy