feat: homelab case study from live infra; Traefik-based deploy

- rewrote homelab (content + topology diagram + stack) from a live inspection of the host:
  Ubuntu 24.04, ~30 Docker services behind Traefik (Cloudflare-fronted, TLS, HTTP/3),
  Authentik SSO forward-auth, CrowdSec, Pi-hole, self-hosted Gitea + CI runner, socket-proxy,
  per-app network isolation; WordPress framed as being decommissioned (not future arch)
- deploy: docker-compose now uses Traefik labels + traefik_proxy network (was assumed nginx
  edge); .env.example adds SITE_HOST/TRAEFIK_ENTRYPOINT; colophon + ARCHITECTURE/DOCKER/
  DEPLOYMENT specs corrected nginx-edge -> Traefik (site container still serves via nginx)
- PROJECT_STATUS: pre-launch checklist updated; infra section added

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/spec/ARCHITECTURE.md

@@ -7,7 +7,7 @@ System architecture for the bilingual portfolio. Companion detail specs: ROUTING
 
 ```
                         ┌──────────────────────────── Connor's server ───────────────────────────┐
- Browser ── HTTPS ──►   │  nginx (existing reverse proxy, TLS)                                   │
+ Browser ── HTTPS ──►   │  Traefik (existing host reverse proxy, TLS; Cloudflare-fronted)        │
                         │    ├── cesnimda.co.uk/            → [site] nginx container (static)    │
                         │    ├── cesnimda.co.uk/api/contact → [contact-relay] .NET 9 container   │
                         │    └── git.cesnimda.uk            → Gitea (existing)                   │