Before compose up, docker rm -f any container bound to the host ports from host_apps so orphan/legacy publishers cannot block the nginx bind; force-recreate when cleanup ran.