Rename the app service to landing-app to avoid a Dokploy network collision

Compose aliases a service to its own name on every network it joins,
including the shared external dokploy-network. A service named plain
"app" collided with another project's equally generic "app" on that
same network, so its containers started resolving "app" to this one
instead — breaking oauth-iam's PHP-FPM upstream whenever both stacks
were up together.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -17,19 +17,30 @@
 # cannot run without it: `docker/entrypoint.sh` checks it instead, with a
 # message that says how to generate one. Requiring it at this level would also
 # break generating it in the first place — `docker compose run --rm --no-deps
-# app php artisan key:generate --show` has to work before `APP_KEY` exists.
+# landing-app php artisan key:generate --show` has to work before `APP_KEY`
+# exists.
 #
-# `app` is not published on a host port: it only joins the external
-# `dokploy-network` so Dokploy's Traefik can reach it, and TLS is terminated
-# there before anything reaches this container — same reason
+# The web service is named `landing-app`, not `app`: Compose aliases a
+# service to its own name on every network it joins, `dokploy-network`
+# included, and that network is shared with whatever else Dokploy runs on the
+# same host. A service called plain `app` collides with the equally common
+# `app` another compose project puts on the same network — its containers
+# start resolving `app` to *this* one, on a port nothing here is listening on.
+# That is exactly what broke `oauth-iam`'s PHP-FPM upstream the moment both
+# stacks were up together, and it stops happening the moment the name isn't
+# generic enough to collide.
+#
+# `landing-app` is not published on a host port either: it only joins the
+# external `dokploy-network` so Dokploy's Traefik can reach it, and TLS is
+# terminated there before anything reaches this container — same reason
 # `docker/Caddyfile` trusts `X-Forwarded-*` only from private ranges. The
 # domain itself is configured through Dokploy's own "Domains" tab, which
 # injects its own Traefik labels — don't also add them here, Traefik ends up
 # with two routers for the same Host() and picks one unpredictably.
 #
 # A manual deploy without Dokploy needs its own reverse proxy joined to that
-# network (with its own labels/config), or `app` added back to `default` with
-# a published port.
+# network (with its own labels/config), or `landing-app` added back to
+# `default` with a published port.
 #
 # The web container is the only one that migrates, so a deploy runs them once
 # rather than once per replica.
@@ -121,7 +132,7 @@ x-app-env: &app-env
   MAIL_FROM_NAME: ${MAIL_FROM_NAME:-Pireon Admin}
 
 services:
-  app:
+  landing-app:
     <<: *app
     environment:
       <<: *app-env
@@ -159,7 +170,7 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
-      app:
+      landing-app:
         condition: service_healthy
     healthcheck:
       test: ["CMD", "php", "artisan", "queue:monitor", "default"]
@@ -195,7 +206,7 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
-      app:
+      landing-app:
         condition: service_healthy
     stop_grace_period: 30s