chore: replace Traefik with Nginx Proxy Manager in stack docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -77,7 +77,7 @@ Tessera ist eine modulare, Docker-basierte Webplattform fuer interne Workflow-Au
 |------------|---------|---------|-----|
 | Docker | 27.x | Containerization | Project constraint. Multi-stage builds for production images |
 | Docker Compose | 2.x | Orchestration | Multi-service local dev and production deployment. Health checks, volume management, networking |
-| Traefik | 3.x | Reverse proxy | Automatic SSL, Docker-native service discovery, routing rules via labels. Simpler than nginx for Docker-compose setups |
+| Nginx Proxy Manager | latest | Reverse proxy | External reverse proxy managed by host infrastructure. Tessera containers do not include a reverse proxy — NPM handles SSL termination and routing externally |
 | Gitea | existing | Version control | Already in place. Automate via webhooks and Gitea API |
 
 ### Testing
@@ -114,7 +114,7 @@ Tessera ist eine modulare, Docker-basierte Webplattform fuer interne Workflow-Au
 | Linting | Biome | ESLint + Prettier | Single tool, 100x faster, less config. ESLint is being replaced in NestJS 12 roadmap anyway |
 | Component Library | shadcn/ui | Material UI / Ant Design | shadcn gives ownership of components (no dep lock-in), built on Radix primitives, Tailwind-native |
 | Dashboard Grid | react-grid-layout | Gridstack.js | React-native, TypeScript rewrite in v2, hooks API, responsive breakpoints |
-| Reverse Proxy | Traefik | nginx | Docker-native service discovery, auto-SSL, config via labels not files |
+| Reverse Proxy | Nginx Proxy Manager (external) | Traefik | NPM already in place on host — no proxy inside Tessera containers needed |
 
 ## Multi-Tenancy Strategy