Update environment configuration and enhance Docker setup for production deployment

- Changed NODE_ENV from development to production in .env.example for production readiness.
- Updated WEBUI_URL to point to the new public URL behind Traefik.
- Added internal and external networks in docker-compose.yml for improved service isolation and routing.
- Removed direct port exposure for the WebUI, ensuring it is only accessible through Traefik.
- Refactored landing and login pages in the WebUI to streamline navigation and error handling, redirecting users appropriately based on session status.

.env.example

@@ -1,4 +1,4 @@
-NODE_ENV=development
+NODE_ENV=production
 # Shared by apps/bot (gateway connection) and apps/webui (narrow REST calls +
 # BullMQ job enqueueing for guild backups, giveaways and the scheduler).
 BOT_TOKEN=
@@ -15,12 +15,15 @@ BACKUP_RETENTION_DAYS=14
 BACKUP_CRON=0 3 * * *
 BACKUP_DIR=/backups
 HEALTH_PORT=8080
+# Bot health stays internal (no published port). Override only if you expose it.
 PUBLIC_BASE_URL=http://localhost:8080
 TWITCH_CLIENT_ID=
 TWITCH_CLIENT_SECRET=
 
-# WebUI (apps/webui)
-WEBUI_URL=http://10.111.0.65:3000
+# WebUI (apps/webui) – public URL behind Traefik
+WEBUI_URL=https://dashboard.nexumi.de
+# Discord Developer Portal OAuth2 redirect:
+#   https://dashboard.nexumi.de/api/auth/callback
 # Must be at least 32 characters long. Generate e.g. with `openssl rand -hex 32`.
 SESSION_SECRET=
 # Comma-separated Discord user IDs treated as global bot owners (owner panel, Phase 7 Batch C).