fleet-manager: docs for the Traefik ingress + behind-proxy mode

- .env.example: RP_ORIGIN port-less, FLEET_MGR_ADMIN_BEHIND_PROXY=true, cert vars
  labelled self-TLS-only; ACME vars are now Traefik's (dropped sidecar-only ones).
- DEPLOY.md §2c rewritten for Traefik (443 + Route 53 DNS-01), plus a "Network
  paths" table answering how each plane is reached (enrolment via boot nginx,
  agent direct mTLS via OPNsense L3, admin via Traefik). Start sequence + hardening
  status updated (admin-exposure item resolved).
- README: admin transport = Traefik; behind-proxy explained; config table gains
  BEHIND_PROXY; checkpoint 8 (hardening + Traefik ingress).

serving/fleet-manager/README.md

@@ -14,7 +14,7 @@ network, so external deps are fine (`grpc-go`, `influxdb-client-go`).
 
 | Plane | Transport | Browser/peer identity | Who | Purpose |
 |---|---|---|---|---|
-| **admin** | HTTPS (server-auth) | **WebAuthn/passkey** (YubiKey) → session | admin browsers | JSON API + SPA (monitor / authorise / lifecycle) |
+| **admin** | HTTPS via **Traefik** (:443) → manager | **WebAuthn/passkey** (YubiKey) → session | admin browsers | JSON API + SPA (monitor / authorise / lifecycle) |
 | **agent** | gRPC + mTLS | **fleet CA** (host TPM cert) | enrolled hosts | bidi stream: health/metrics up, desired-state down |
 
 The agent plane uses the host's **reused TPM identity cert** (the same one used
@@ -36,14 +36,16 @@ that's service-to-service — see [Authorise](#authorise-pillar).)
   be enrolled from the UI once one exists.
 - **RP is origin-bound**: `FLEET_MGR_RP_ID` / `FLEET_MGR_RP_ORIGIN` must be the
   UI's real hostname — for this deployment **`diskless-server.bitasylum.org`** /
-  `https://diskless-server.bitasylum.org`.
-- **HTTPS cert** for the UI is a publicly-trusted cert via **Let's Encrypt
-  DNS-01** (the UI is on the mgmt network, not internet-reachable, so HTTP-01 /
-  TLS-ALPN-01 can't validate; DNS-01 proves control of `bitasylum.org` via a TXT
-  record and supports wildcards). An external ACME client (lego/certbot + DNS
-  provider) issues + renews to `FLEET_MGR_ADMIN_CERT/_KEY`; the manager
-  **hot-reloads** the cert on renewal (no restart). A trusted cert also keeps the
-  WebAuthn secure-context clean (no browser warnings).
+  `https://diskless-server.bitasylum.org` (port-less, since Traefik serves :443).
+- **TLS + cert** are owned by the **`traefik`** mgmt-plane ingress: it terminates
+  a publicly-trusted **Let's Encrypt** cert (**Route 53 DNS-01** — the UI is on the
+  mgmt network, not internet-reachable, so HTTP-01/TLS-ALPN-01 can't validate) on
+  :443 and forwards plaintext to the manager, which runs
+  `FLEET_MGR_ADMIN_BEHIND_PROXY=true` (passkey auth ON, plaintext on loopback —
+  WebAuthn only needs the origin to match, not the app's own transport). Traefik
+  is the k8s ingress-controller + cert-manager role in miniature. *(Self-TLS mode
+  without Traefik is still available: `BEHIND_PROXY=false` + a cert at
+  `FLEET_MGR_ADMIN_CERT/_KEY`, e.g. from `acme/renew-loop.sh`.)*
 
 ## Monitoring path (no host ever touches InfluxDB)
 
@@ -114,8 +116,9 @@ inventory for offline delivery. Metrics writing is behind a `MetricsSink`
 
 | Var | Default | Notes |
 |---|---|---|
-| `FLEET_MGR_ADMIN_ADDR` | `127.0.0.1:9500` | admin listener |
-| `FLEET_MGR_ADMIN_CERT` / `_KEY` | — | UI server cert/key (server-auth; **LE DNS-01**, hot-reloaded) |
+| `FLEET_MGR_ADMIN_ADDR` | `127.0.0.1:9500` | admin listener (loopback — Traefik forwards here) |
+| `FLEET_MGR_ADMIN_BEHIND_PROXY` | `false` | passkey ON, plaintext listener (Traefik/ingress terminates TLS). Compose defaults it `true` |
+| `FLEET_MGR_ADMIN_CERT` / `_KEY` | — | UI server cert/key — **self-TLS mode only** (`BEHIND_PROXY=false`, no Traefik) |
 | `FLEET_MGR_RP_ID` | — | WebAuthn RP ID = UI hostname (`diskless-server.bitasylum.org`) |
 | `FLEET_MGR_RP_ORIGIN` | — | WebAuthn origin (`https://diskless-server.bitasylum.org`) |
 | `FLEET_MGR_RP_NAME` | `Fleet Command` | RP display name |
@@ -189,3 +192,9 @@ curl -s localhost:9500/api/hosts | jq '.hosts[] | {name:.identity.starship_name,
   server cert), and [`DEPLOY.md`](DEPLOY.md) (PKI, LE DNS-01, `register-admin`
   bootstrap). Design docs updated (manager marked built; resolved transport/auth/
   metrics forks; per-host-versioning gap recorded).
+- **Checkpoint 8 (done):** hardening + ingress — CI image build
+  (`fleet-manager-image.yaml`, pulled by tag), `backup.sh`; a **behind-proxy admin
+  mode** (passkey over plaintext behind a TLS-terminating proxy) fronted by a
+  **Traefik** mgmt ingress (:443 + Route 53 DNS-01, retiring the acme side-car).
+  This aligns with the k8s target (Traefik → ingress controller + cert-manager);
+  the agent plane stays direct mTLS via OPNsense L3. See [`DEPLOY.md`](DEPLOY.md).