fleet-manager: docs for the Traefik ingress + behind-proxy mode

- .env.example: RP_ORIGIN port-less, FLEET_MGR_ADMIN_BEHIND_PROXY=true, cert vars
  labelled self-TLS-only; ACME vars are now Traefik's (dropped sidecar-only ones).
- DEPLOY.md §2c rewritten for Traefik (443 + Route 53 DNS-01), plus a "Network
  paths" table answering how each plane is reached (enrolment via boot nginx,
  agent direct mTLS via OPNsense L3, admin via Traefik). Start sequence + hardening
  status updated (admin-exposure item resolved).
- README: admin transport = Traefik; behind-proxy explained; config table gains
  BEHIND_PROXY; checkpoint 8 (hardening + Traefik ingress).

serving/fleet-manager/.env.example

@@ -2,40 +2,36 @@
 # .env is gitignored — it holds the Influx token and DB password.
 
 # --- WebAuthn RP (admin passkeys are ORIGIN-BOUND — must be the UI's real URL) --
-# For this deployment the UI is https://diskless-server.bitasylum.org .
+# The UI is fronted by Traefik on :443, so the origin is PORT-LESS.
 FLEET_MGR_RP_ID=diskless-server.bitasylum.org
 FLEET_MGR_RP_ORIGIN=https://diskless-server.bitasylum.org
 FLEET_MGR_RP_NAME=Fleet Command
 
-# --- admin plane HTTPS ---------------------------------------------------------
-# The UI cert is a publicly-trusted Let's Encrypt cert via DNS-01 (the UI is on
-# the mgmt net, not internet-reachable, so HTTP-01/TLS-ALPN-01 can't validate;
-# DNS-01 proves control of bitasylum.org via a TXT record). An external ACME
-# client (lego/certbot + your DNS provider) writes fullchain/privkey into
-# ./pki/admin/ ; the manager hot-reloads on renewal. See DEPLOY.md.
+# --- admin plane (behind the Traefik ingress) ----------------------------------
+# Traefik terminates the LE cert on :443 and forwards plaintext here; the manager
+# keeps passkey auth ON but serves plaintext on loopback (only Traefik reaches it).
 FLEET_MGR_ADMIN_ADDR=127.0.0.1:9500
-FLEET_MGR_ADMIN_CERT=/pki/admin/fullchain.pem
-FLEET_MGR_ADMIN_KEY=/pki/admin/privkey.pem
+FLEET_MGR_ADMIN_BEHIND_PROXY=true
 # Dev-only escape hatch: plaintext, NO passkey auth. NEVER set true in prod.
 FLEET_MGR_ADMIN_INSECURE=false
+# Only for self-TLS mode (BEHIND_PROXY=false + a cert, no Traefik — see DEPLOY.md):
+FLEET_MGR_ADMIN_CERT=/pki/admin/fullchain.pem
+FLEET_MGR_ADMIN_KEY=/pki/admin/privkey.pem
 
-# --- admin UI cert: Let's Encrypt DNS-01 via Route 53 (the `acme` side-car) -----
-# The side-car issues + auto-renews the UI cert into ./pki/admin/ ; the manager
-# hot-reloads it. ACME_DOMAIN is taken from FLEET_MGR_RP_ID above. Give it AWS
-# creds scoped to the bitasylum.org hosted zone (IAM policy in DEPLOY.md §2c), or
-# omit them and attach an instance role.
+# --- Traefik ACME (Let's Encrypt DNS-01 via Route 53) --------------------------
+# Traefik issues + auto-renews the :443 cert. Set the UI hostname in
+# traefik/dynamic/fleet-manager.yml (== FLEET_MGR_RP_ID). Give it AWS creds scoped
+# to the bitasylum.org hosted zone (IAM policy in DEPLOY.md §2c), or attach an
+# instance role and leave them blank.
 ACME_EMAIL=you@bitasylum.org
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 AWS_REGION=us-east-1
-# Optional but recommended: pin the Route 53 zone. Skips ListHostedZonesByName
-# (so you can drop it from the IAM policy) and disambiguates public/private zones.
+# Optional but recommended: pin the Route 53 zone (skip ListHostedZonesByName;
+# disambiguate public/private zones). Traefik reads it from the env.
 AWS_HOSTED_ZONE_ID=
-# Public resolver(s) for the DNS-01 propagation check (comma-separated host:port).
-# Needed because internal/split-horizon DNS won't resolve the public challenge
-# record. Defaults to Google DNS; override if 8.8.8.8 is blocked (e.g. 1.1.1.1:53).
-ACME_RESOLVERS=8.8.8.8:53
-# ACME_STAGING=1   # uncomment for a dry-run vs LE staging (UNTRUSTED certs, no rate limit)
+# First dry-run vs LE staging: add the caserver flag to the traefik command (see
+# docker-compose.yml) rather than an env var.
 
 # --- agent plane (gRPC + mTLS, fleet CA) ---------------------------------------
 # Routable mgmt address enrolled hosts dial (":9600" = all interfaces). The