Step 2/2 (Audit Gitea #17). NPM's proxy host now forwards to pawfeed:3000 over the shared nginx_default Docker network (verified working in the previous deploy), so the app no longer needs a published host port at all — it was reachable unencrypted on the LAN, bypassing Cloudflare's TLS termination and protections entirely.