Public-flip audit: env-driven paths, scrub audit-ticket prefixes, terser README

the host bind paths + LAN host pins replaced with env defaults. Repository URLs
→ git.sulkta.com. Audit-changelog scaffolding stripped from inline comments
(technical reasoning preserved). README sheds marketing scaffolding. AI-speak
in load-bearing prompts/SOULs left alone — that IS the product.

compose.yml

@@ -9,17 +9,8 @@ services:
     container_name: cauldron
     restart: unless-stopped
     env_file:
-      - /srv/secrets/cauldron.env
+      # Point at wherever your secrets file lives. Override via .env at the
+      # compose root: `CAULDRON_ENV_FILE=/srv/secrets/cauldron.env`.
+      - ${CAULDRON_ENV_FILE:-./.env}
     ports:
-      # LAN-only. Same pattern as cwho on 7777.
-      - "0.0.0.0:7790:7790"
-      - "127.0.0.1:7790:7790"
-    networks:
-      - sulkta
-      - backend-net
-
-networks:
-  sulkta:
-    external: true
-  backend-net:
-    external: true
+      - "${CAULDRON_BIND:-0.0.0.0}:${CAULDRON_PORT:-7790}:7790"