fix(docker): remove network_mode for Dokploy compatibility

Dokploy injects 'networks' into all compose services for Traefik routing,
which is mutually exclusive with 'network_mode: service:supabase-kong'.

Changes:
- Remove network_mode from app service
- App server-side Supabase URL: http://supabase-kong:8000 (Docker DNS)
- App browser-side Supabase URL: ${API_EXTERNAL_URL} (external domain)
- Kong catch-all route: app:3000 instead of localhost:3000

docker-compose.yml

@@ -309,7 +309,8 @@ services:
       dockerfile: Dockerfile
       args:
         NEXT_PUBLIC_SITE_URL: ${SITE_URL:-https://myeasycms.de}
-        NEXT_PUBLIC_SUPABASE_URL: http://localhost:8000
+        # Browser-side Supabase URL — goes through external domain (Traefik → Kong)
+        NEXT_PUBLIC_SUPABASE_URL: ${API_EXTERNAL_URL:-http://localhost:8000}
         NEXT_PUBLIC_SUPABASE_PUBLIC_KEY: ${SUPABASE_ANON_KEY}
     restart: unless-stopped
     depends_on:
@@ -317,14 +318,11 @@ services:
         condition: service_healthy
       supabase-db-migrate:
         condition: service_completed_successfully
-    # App shares Kong's network namespace — localhost:8000 inside the container
-    # reaches Kong directly. This keeps the same URL for browser AND server,
-    # so Supabase cookie names match without any code changes.
-    network_mode: "service:supabase-kong"
     environment:
       NODE_ENV: production
       NEXT_PUBLIC_SITE_URL: ${SITE_URL:-http://localhost:3000}
-      NEXT_PUBLIC_SUPABASE_URL: http://localhost:8000
+      # Server-side Supabase URL — direct Docker network access to Kong
+      NEXT_PUBLIC_SUPABASE_URL: http://supabase-kong:8000
       NEXT_PUBLIC_SUPABASE_PUBLIC_KEY: ${SUPABASE_ANON_KEY}
       SUPABASE_SECRET_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
       SUPABASE_DB_WEBHOOK_SECRET: ${DB_WEBHOOK_SECRET:-webhooksecret}