docs: clarify traffic architecture and ae_app vs ae_api scaling options

CHEATSHEET.md

@@ -19,9 +19,36 @@
 - **Automated Import:** Drop file in `backups/import/` -> Run `./check_and_import.sh`.
 
 ## 📈 Scaling
-1. Edit `.env` -> `AE_API_REPLICAS=X` (or `AE_APP_REPLICAS=X`)
+
+### ae_api — scales via Docker DNS (no host ports needed)
+`ae_api` has no host ports. External traffic enters via `ae_web_dev` (port 5060/443),
+which round-robins across all `ae_api` replicas using Docker's internal DNS.
+
+1. Edit `.env` → `AE_API_REPLICAS=X`
 2. Run `docker compose up -d`
 
+No home-server nginx changes needed.
+
+### ae_app — two scaling options
+
+**Option A (recommended): Route through ae_web_dev (same as ae_api)**
+- Home server nginx points `dev-*.oneskyit.com` at `workstation:443`
+- ae_web_dev round-robins to `ae_app` replicas via Docker DNS
+- No host ports needed on ae_app, no home nginx changes when scaling
+- Same topology as ae_api
+
+**Option B (current): Direct host port binding**
+- Home server nginx points at `workstation:3001`, `3002`, etc.
+- `AE_APP_NODE_PORT_RANGE=3001-3006` in `.env`; Docker assigns one port per replica
+- Must uncomment matching entries in home server nginx upstream when adding replicas
+- Maximum 6 replicas without changing the range
+
+To scale with Option B:
+1. Edit `.env` → `AE_APP_REPLICAS=X` (max 6 with current range)
+2. Run `docker compose up -d ae_app`
+3. Uncomment matching port entries in home server nginx upstream
+4. Reload home server nginx
+
 ## 🧹 Maintenance
 - **Internal Logs:** Docker handles rotation automatically (10MB limit).
 - **External Proxy:** Point your home server to `[Workstation_IP]:5060`.