feat(swarm): add coordinator service and reorganize compose files

- Add coordinator service to docker-compose.swarm.portainer.yml and
  docker-compose.swarm.yml with full environment config and healthcheck
- Add ANTHROPIC_API_KEY and coordinator settings to .env.swarm.example
- Move docker-compose.override.yml.example and docker-compose.prod.yml
  into docker/ directory
- Add *.bak to .gitignore

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker/docker-compose.override.yml.example

@@ -0,0 +1,147 @@
+# Docker Compose Override Example
+# Copy this file to docker-compose.override.yml to customize your deployment
+# Usage: docker compose up (automatically uses both docker-compose.yml and docker-compose.override.yml)
+
+version: '3.9'
+
+services:
+  # ======================
+  # Example: Use External PostgreSQL
+  # ======================
+  # Uncomment to disable the bundled PostgreSQL and use an external instance
+  # postgres:
+  #   profiles:
+  #     - disabled
+
+  # api:
+  #   environment:
+  #     DATABASE_URL: postgresql://user:password@external-postgres.example.com:5432/mosaic
+
+  # ======================
+  # Example: Use External Valkey/Redis
+  # ======================
+  # Uncomment to disable the bundled Valkey and use an external instance
+  # valkey:
+  #   profiles:
+  #     - disabled
+
+  # api:
+  #   environment:
+  #     VALKEY_URL: redis://external-redis.example.com:6379
+
+  # ======================
+  # Example: Use External Ollama
+  # ======================
+  # Uncomment to disable the bundled Ollama and use an external instance
+  # ollama:
+  #   profiles:
+  #     - disabled
+
+  # api:
+  #   environment:
+  #     OLLAMA_ENDPOINT: http://external-ollama.example.com:11434
+
+  # ======================
+  # Example: Development Overrides
+  # ======================
+  # Uncomment for development-specific settings
+  # postgres:
+  #   ports:
+  #     - "5432:5432"
+  #   command:
+  #     - "postgres"
+  #     - "-c"
+  #     - "log_statement=all"
+  #     - "-c"
+  #     - "log_duration=on"
+
+  # api:
+  #   environment:
+  #     NODE_ENV: development
+  #     LOG_LEVEL: debug
+  #   volumes:
+  #     - ./apps/api/src:/app/apps/api/src:ro
+
+  # web:
+  #   environment:
+  #     NODE_ENV: development
+  #   volumes:
+  #     - ./apps/web/src:/app/apps/web/src:ro
+
+  # ======================
+  # Example: Enable GPU for Ollama
+  # ======================
+  # Uncomment to enable GPU support for Ollama (requires NVIDIA Docker runtime)
+  # ollama:
+  #   deploy:
+  #     resources:
+  #       reservations:
+  #         devices:
+  #           - driver: nvidia
+  #             count: 1
+  #             capabilities: [gpu]
+
+  # ======================
+  # Example: Traefik Upstream Mode
+  # ======================
+  # Connect to an existing external Traefik instance
+  # 1. Set TRAEFIK_MODE=upstream in .env
+  # 2. Set TRAEFIK_ENABLE=true in .env
+  # 3. Set TRAEFIK_NETWORK=traefik-public (or your network name)
+  # 4. Uncomment the network section below
+  # 5. Ensure external Traefik network exists: docker network create traefik-public
+  #
+  # api:
+  #   networks:
+  #     - traefik-public
+  #
+  # web:
+  #   networks:
+  #     - traefik-public
+  #
+  # authentik-server:
+  #   networks:
+  #     - traefik-public
+
+  # ======================
+  # Example: Traefik with Custom Middleware
+  # ======================
+  # Add authentication or other middleware to routes
+  # traefik:
+  #   labels:
+  #     # Basic auth middleware
+  #     - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$xyz..."
+  #
+  # api:
+  #   labels:
+  #     # Apply middleware to API router
+  #     - "traefik.http.routers.mosaic-api.middlewares=auth@docker"
+
+  # ======================
+  # Example: Traefik with Let's Encrypt (Production)
+  # ======================
+  # Enable automatic SSL with Let's Encrypt
+  # 1. Set TRAEFIK_ACME_EMAIL in .env
+  # 2. Set TRAEFIK_CERTRESOLVER=letsencrypt in .env
+  # 3. Uncomment Traefik ACME configuration in docker/traefik/traefik.yml
+  # 4. Ensure ports 80 and 443 are accessible from the internet
+  #
+  # No additional overrides needed - configured in traefik.yml
+
+  # ======================
+  # Example: Traefik with Custom Domains
+  # ======================
+  # Override default domains for production deployment
+  # Set these in .env instead:
+  #   MOSAIC_API_DOMAIN=api.example.com
+  #   MOSAIC_WEB_DOMAIN=example.com
+  #   MOSAIC_AUTH_DOMAIN=auth.example.com
+
+# ======================
+# Networks
+# ======================
+# Uncomment when using upstream Traefik mode
+# networks:
+#   traefik-public:
+#     external: true
+#     name: ${TRAEFIK_NETWORK:-traefik-public}