fix(routing): rename main service app->pds so caddy resolves THIS stack on shared proxy

The caddy sidecar uses on-demand TLS and asks http://app:3000/tls-check before issuing a cert. On a
multi-tenant host every co-located stack aliases its main service 'app' on the shared 'proxy' overlay;
caddy (on proxy+internal) resolves bare 'app' to a FOREIGN stack's endpoint, the tls-check is refused,
no cert is issued, and HTTPS is dead (xrpc/_health=000). Renaming the service to 'pds' gives a unique
swarm DNS name that only this stack publishes, so caddy's reverse_proxy/on_demand_tls always resolve
this PDS. (A network alias would be cleaner but abra drops compose network aliases on deploy; the
service name is always applied.)

cc @trav @notplants

compose.yml

@@ -2,17 +2,10 @@
 version: "3.8"
 
 services:
-  app:
+  pds:
     image: ghcr.io/bluesky-social/pds:0.4.219
     networks:
-      # Unique alias so the caddy sidecar resolves THIS stack's PDS, not a foreign service. On a
-      # shared host the default service name `app` is aliased by every co-located stack on the
-      # `proxy` overlay; caddy (attached to both `proxy` and `internal`) otherwise resolves bare
-      # `app` to another stack's endpoint, so its on-demand-TLS `ask` to the PDS is refused and the
-      # cert is never issued (HTTPS dead). `pds` exists only on `internal`, so it resolves correctly.
-      internal:
-        aliases:
-          - pds
+      - internal
     environment:
       - PDS_HOSTNAME=${DOMAIN}
       - PDS_DATA_DIRECTORY=/pds