fleet-manager: front the admin UI with Traefik (443 + Route 53 ACME), retire acme side-car

Management-plane ingress: a host-networked Traefik terminates the LE cert on :443
(Route 53 DNS-01, public-resolver propagation check) and forwards plaintext to
the manager running FLEET_MGR_ADMIN_BEHIND_PROXY=true on loopback :9500. Only the
admin plane rides Traefik — the agent gRPC/mTLS plane (:9600) stays direct (Traefik
can't terminate fleet-CA mTLS; hosts reach it via OPNsense L3 routing). This is the
k8s ingress-controller + cert-manager role in miniature.

- traefik/dynamic/fleet-manager.yml: file-provider router (Host rule -> manager),
  passHostHeader so the WebAuthn RP origin matches.
- compose: traefik service (static config as CLI flags so ${ACME_EMAIL} interpolates)
  + traefik-acme volume; manager switched to behind-proxy defaults, RP_ORIGIN now
  the port-less https origin.
- Retire the acme side-car (Traefik owns ACME now): remove the service + acme-state
  volume; renew-loop.sh kept + relabelled as the self-TLS-mode cert helper.
- :443 only (admin UI is https-only) so it can't collide with a boot-LAN nginx :80.

serving/fleet-manager/acme/renew-loop.sh

@@ -1,5 +1,10 @@
 #!/bin/sh
-# renew-loop.sh — admin-UI cert issue/renew loop for the `acme` side-car.
+# renew-loop.sh — admin-UI cert issue/renew loop (self-TLS alternative).
+#
+# NOTE: the default deployment fronts the admin UI with Traefik (docker-compose.yml),
+# which owns ACME itself — this script is NOT used then. It remains as the cert
+# helper for the SELF-TLS admin mode (FLEET_MGR_ADMIN_BEHIND_PROXY=false, no
+# Traefik): run it under a `goacme/lego` container to write ./pki/admin/.
 #
 # Runs inside the goacme/lego image (alpine-based). Obtains the fleet-manager
 # admin-UI cert from Let's Encrypt via DNS-01 over AWS Route 53, and writes it