feat: homelab case study from live infra; Traefik-based deploy

- rewrote homelab (content + topology diagram + stack) from a live inspection of the host:
  Ubuntu 24.04, ~30 Docker services behind Traefik (Cloudflare-fronted, TLS, HTTP/3),
  Authentik SSO forward-auth, CrowdSec, Pi-hole, self-hosted Gitea + CI runner, socket-proxy,
  per-app network isolation; WordPress framed as being decommissioned (not future arch)
- deploy: docker-compose now uses Traefik labels + traefik_proxy network (was assumed nginx
  edge); .env.example adds SITE_HOST/TRAEFIK_ENTRYPOINT; colophon + ARCHITECTURE/DOCKER/
  DEPLOYMENT specs corrected nginx-edge -> Traefik (site container still serves via nginx)
- PROJECT_STATUS: pre-launch checklist updated; infra section added

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/spec/ARCHITECTURE.md

@@ -7,7 +7,7 @@ System architecture for the bilingual portfolio. Companion detail specs: ROUTING
 
 ```
                         ┌──────────────────────────── Connor's server ───────────────────────────┐
- Browser ── HTTPS ──►   │  nginx (existing reverse proxy, TLS)                                   │
+ Browser ── HTTPS ──►   │  Traefik (existing host reverse proxy, TLS; Cloudflare-fronted)        │
                         │    ├── cesnimda.co.uk/            → [site] nginx container (static)    │
                         │    ├── cesnimda.co.uk/api/contact → [contact-relay] .NET 9 container   │
                         │    └── git.cesnimda.uk            → Gitea (existing)                   │

docs/spec/DEPLOYMENT_SPEC.md

@@ -33,7 +33,7 @@ push / PR to main
 
 1. Pre-launch: staging fully verified (both locales, CV downloads, form → real mailbox, redirects incl. `/Linkedin`, 410 map, OG previews via LinkedIn/Slack debuggers, Search Console fetch).
 2. URL inventory + redirect/410 map finalised (SEO_SPEC §6).
-3. Cutover = repoint host nginx server-block from WP to the `site` container (single reload; WP left running dark for 2 weeks as instant rollback).
+3. Cutover = move the `cesnimda.co.uk` Traefik Host router from the WordPress container to the `site` container (a label change + `compose up -d`; WP left running dark for 2 weeks as instant rollback).
 4. Post-launch checklist: submit sitemaps, watch Search Console coverage + relay logs for form spam patterns, then decommission WP + its PHP/MySQL surface (attack-surface win worth noting on the colophon).
 
 ## 4. Operational guardrails

docs/spec/DOCKER_SPEC.md

@@ -31,7 +31,7 @@ deploy/
   .env.example                  # documented variables, no real values
 ```
 
-- Prod compose joins the server's existing reverse-proxy network; the host nginx (existing, TLS-terminating) routes `cesnimda.co.uk` → `site:8080` and `cesnimda.co.uk/api/contact` → `contact-relay:8081`. The stack publishes **no host ports** itself.
+- Prod compose joins the server's existing Traefik network (`traefik_proxy`); the host Traefik (existing, TLS-terminating, Cloudflare-fronted) discovers the containers via labels and routes `cesnimda.co.uk` → `site:8080` and `cesnimda.co.uk/api/contact` → `relay:8081` (the relay's `PathPrefix` rule outranks the site's `Host` rule). The stack publishes **no host ports** itself.
 - `restart: unless-stopped`, log rotation via compose logging options, images referenced by registry tag + digest.
 - Optional third service slot (`analytics`, self-hosted Umami/Plausible) reserved in the compose file as a commented profile — decision deferred.