docs: sync remaining md (AGENTS, ARCHITECTURE, READMEs to 4001/4009, Nix)

services/backend/ARCHITECTURE.md

@@ -225,14 +225,14 @@ All config via environment variables (`.env`), validated with Zod in `shared/con
 
 ```env
 # Server
-WEBSERVER_PORT=3001
+WEBSERVER_PORT=4001
 NODE_ENV=development
 LOG_LEVEL=info
 
 # Database
 DATABASE_URL=postgresql://asephs:***@100.121.180.82:6432/discord_moderation
 # OR
-DATABASE_HOST=localhost
+DATABASE_HOST=100.121.180.82
 DATABASE_PORT=6432
 DATABASE_NAME=discord_moderation
 DATABASE_USER=postgres
@@ -263,7 +263,7 @@ Use Vitest with mocked database and services.
 2. **Implement repository queries** for each module using Drizzle ORM
 3. **Add WebSocket server** in `src/ws/server.ts` with Redis pub/sub listener
 4. **Create Discord Gateway service** in `services/discord-gateway/` (separate microservice)
-5. **Add Docker & CI/CD** for multi-service deployment
+5. **Add Nix & CI/CD** for multi-service deployment (flake.nix + GitHub Actions → nix copy → systemd)
 6. **Write integration tests** for full request flow
 
 ## Circular Dependency Check

services/discord-gateway/README.md

@@ -243,10 +243,10 @@ On SIGINT/SIGTERM/uncaughtException/unhandledRejection:
    - Connect to Backend HTTP API
    - Subscribe to WebSocket events
 
-3. **Docker & CI/CD**
-   - Dockerfile for Discord Gateway
-   - Docker Compose for multi-service setup
-   - GitHub Actions for build/deploy
+3. **Nix & CI/CD**
+   - flake.nix package for Discord Gateway
+   - systemd services (gmw-backend, gmw-discord-gateway)
+   - GitHub Actions for build/deploy (nix copy → systemctl restart)
 
 4. **Documentation**
    - API documentation

services/frontend/AGENTS.md

@@ -17,9 +17,9 @@ Discord → discord-gateway → Redis pub/sub → backend (Express :4001) ←→
                                                 └ WS /ws (events + PCM binary)
 ```
 
-- **Base URL**: API + WS default to same-origin. `gmw-proxy` nginx (:8080)
-  proxies `/api` and `/ws` to the backend on :3001. Public host:
-  `imphnen.asepharyana.my.id` (Cloudflare SSL in front of Traefik → :8080).
+- **Base URL**: API + WS default to same-origin. `gmw-proxy` nginx (:4009)
+  proxies `/api` and `/ws` to the backend on :4001. Public host:
+  `imphnen.asepharyana.my.id` (Caddy reverse proxy → :4009).
 - Local dev overrides: `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_WS_URL`
   (e.g. https://imphnen.asepharyana.my.id).
 - **Never hardcode a host** in api/ws clients — same-origin or env override only.