stage-9: consolidate into one compose stack behind nginx-proxy

psyc now runs as a single docker compose stack — cockpit + mock-cert +
(gpu-profile) inference — on the shared external `backend` network, fronted
by nginx-proxy as psyc.neuronetz.ai. Replaces the venv processes + one-off
docker run. MOCK_CERT_BASE and INFERENCE_URL are now env-configurable
(PSYC_MOCK_CERT_URL / PSYC_INFERENCE_URL) so the cockpit reaches the other
services by compose service name. Restart policies + healthchecks. deploy.md
rewritten to match.

Verified: cockpit serves directly and via the proxy; the full
scout→…→courier→ledger chain runs over the compose network.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/psyc/cockpit/inference.py

@@ -8,6 +8,7 @@ gracefully — if the server is down, callers get None and fall back to rules.
 from __future__ import annotations
 
 import json
+import os
 from typing import Optional
 
 import httpx
@@ -17,7 +18,7 @@ from psyc.lines.train import SEVERITY_INSTRUCTION, severity_features
 from psyc.models import Case
 
 
-INFERENCE_URL = "http://127.0.0.1:8771"
+INFERENCE_URL = os.environ.get("PSYC_INFERENCE_URL", "http://127.0.0.1:8771")
 
 _log = log.get(__name__)
 

src/psyc/lines/route.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import os
 from typing import Dict, List, Optional, Tuple
 
 from pydantic import BaseModel, Field
@@ -15,7 +16,7 @@ _log = log.get(__name__)
 
 _TLP_RANK: Dict[TLP, int] = {TLP.CLEAR: 0, TLP.GREEN: 1, TLP.AMBER: 2, TLP.RED: 3}
 
-MOCK_CERT_BASE = "http://127.0.0.1:8770"
+MOCK_CERT_BASE = os.environ.get("PSYC_MOCK_CERT_URL", "http://127.0.0.1:8770")
 
 ENDPOINTS: Dict[str, str] = {
     "CERT-Bund": f"{MOCK_CERT_BASE}/cert-bund/submit",