feat/Update_Controllers_to_Allow_for_Premium_Membership

docs/architecture/deployment.md

@@ -5,9 +5,14 @@ Compose. The backend is not published directly; nginx proxies `/api`. `deploy/de
 configuration, takes and verifies a provider-appropriate backup before replacement, builds/restarts the
 stack, and performs health checks.
 
-Production compose enables `Proxy:TrustForwardedHeaders` because nginx is the sole ingress, allowing
-HTTPS scheme and client-IP rate limits to use one trusted forwarded hop. The development override
-publishes the API directly and disables forwarded-header trust.
+Production commands explicitly select `docker-compose.yml`; it publishes no application ports.
+Traefik reaches frontend/nginx over `jobtracker_shared`, must match the canonical Host exactly, and
+must replace `X-Forwarded-For` and `X-Forwarded-Proto`. Nginx passes those sanitized values to the
+backend over the dedicated `WEB_PROXY_SUBNET`; nginx also derives its only application server name
+from `APP_PUBLIC_BASE_URL` and rejects unknown Hosts except its liveness endpoint. The backend trusts
+only the dedicated CIDR and one forwarded hop. Local development explicitly adds
+`docker-compose.dev.yml`, which publishes ports 3000/5202, uses the localhost origin, and disables
+forwarded-header trust.
 
 Each service rotates local Docker logs at 10 MB and retains three files. Add a central sink only if
 cross-host search or longer retention becomes necessary.