fix: route backend->gotrue through caddy with transparent host header

The backend's @supabase/supabase-js client constructs URLs as
${SUPABASE_URL}/auth/v1/..., so SUPABASE_URL must point at a layer
that strips /auth/v1/ before forwarding to GoTrue (which serves at
the root path). Pointing it at gotrue:9999 directly returned 404
on every auth call, causing all backend endpoints to return 401.

Two changes:
- Caddy site address relaxed from {$MIKE_HOST}:{$MIKE_PORT} to
  :{$MIKE_PORT} so internal services (caddy:80) reach it without
  Host-header matching games.
- reverse_proxy directives set 'header_up Host {upstream_hostport}'
  so Caddy presents the upstream's address as the Host header instead
  of forwarding the inbound Host through, which was causing GoTrue
  to return empty 200 responses for in-cluster requests.
- mike-backend SUPABASE_URL now points at http://caddy:${MIKE_PORT}.