Disable signups; use crowdsec-bouncer@docker; drop redundant HTTP router

signups_allowed was drifted to true on prod and is now false in both
docker-compose.yml and data/config.json. config.json overrides the env var,
so setting the compose value alone has no effect.

The bouncer moved from @file to @docker because its API key is now a compose
label sourced from .env, keeping config.yml secret-free.

The vaultwarden-http router is removed as redundant: traefik.yml already
redirects the http entrypoint to https globally (verified: http returns 301).

docker-compose.yml

@@ -29,12 +29,6 @@ services:
       - "traefik.http.middlewares.vaultwarden-headers.headers.customResponseHeaders.X-Robots-Tag=noindex, nofollow"
       - "traefik.http.middlewares.vaultwarden-headers.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN"
 
-      # HTTP to HTTPS redirect
-      - "traefik.http.routers.vaultwarden-http.rule=Host(`${DOMAIN}`)"
-      - "traefik.http.routers.vaultwarden-http.entrypoints=http"
-      - "traefik.http.routers.vaultwarden-http.service=vaultwarden"
-      - "traefik.http.routers.vaultwarden-http.priority=100"
-      - "traefik.http.routers.vaultwarden-http.middlewares=redirect-to-https@docker"
 
       # Main HTTP/HTTPS router
       - "traefik.http.routers.vaultwarden.rule=Host(`${DOMAIN}`)"
@@ -43,7 +37,7 @@ services:
       - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
       - "traefik.http.routers.vaultwarden.service=vaultwarden"
       - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
-      - "traefik.http.routers.vaultwarden.middlewares=geoblock@file,vaultwarden-headers,crowdsec-bouncer@file"
+      - "traefik.http.routers.vaultwarden.middlewares=geoblock@file,vaultwarden-headers,crowdsec-bouncer@docker"
 
       # WebSocket router (required for real-time sync)
       - "traefik.http.routers.vaultwarden-ws.rule=Host(`${DOMAIN}`) && Path(`/notifications/hub`)"
@@ -52,7 +46,7 @@ services:
       - "traefik.http.routers.vaultwarden-ws.tls.certresolver=letsencrypt"
       - "traefik.http.routers.vaultwarden-ws.service=vaultwarden-ws"
       - "traefik.http.services.vaultwarden-ws.loadbalancer.server.port=3012"
-      - "traefik.http.routers.vaultwarden-ws.middlewares=geoblock@file,crowdsec-bouncer@file"
+      - "traefik.http.routers.vaultwarden-ws.middlewares=geoblock@file,crowdsec-bouncer@docker"
 
       # Admin panel router (restricted to internal IPs)
       - "traefik.http.routers.vaultwarden-admin.rule=Host(`${DOMAIN}`) && PathPrefix(`/admin`)"
@@ -60,7 +54,7 @@ services:
       - "traefik.http.routers.vaultwarden-admin.tls=true"
       - "traefik.http.routers.vaultwarden-admin.tls.certresolver=letsencrypt"
       - "traefik.http.routers.vaultwarden-admin.service=vaultwarden"
-      - "traefik.http.routers.vaultwarden-admin.middlewares=internal-whitelist@file,crowdsec-bouncer@file"
+      - "traefik.http.routers.vaultwarden-admin.middlewares=internal-whitelist@file,crowdsec-bouncer@docker"
 
 networks:
   traefik: