crafty-controller: Traefik https backend scheme + scoped skip-verify transport (fixes 502 to TLS backend)

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 2026-06-26 — crafty-controller: Traefik https backend + scoped skip-verify (fixes 502)
+- **crafty-controller**: the healthcheck fix un-withheld the Traefik route, exposing a pre-existing
+  **502** — Traefik proxied `http://…:8443` to Crafty's **HTTPS-only** self-signed backend (Crafty serves
+  no plain-HTTP panel; `:8000` only redirects). Added two service labels:
+  - `loadbalancer.server.scheme=https` — Traefik now speaks HTTPS to the backend.
+  - `loadbalancer.serverstransport=insecure-skip-verify@file` — references the **named**
+    serversTransport defined in the controller-managed Traefik dynamic config (felhom-controller v0.83.0),
+    which skips verifying Crafty's per-container self-signed cert. Verification stays ON for every other
+    backend (scoped Option B; no global `insecureSkipVerify`). The `@file` suffix is the cross-provider
+    reference from the docker provider to the file-provider transport.
+  - Requires felhom-controller ≥ v0.83.0 (which renders the `insecure-skip-verify` transport). `port=8443`
+    and the router/tls labels are unchanged.
+
 ## 2026-06-26 — crafty-controller healthcheck fix (curl-absent + http-vs-TLS probe)
 - **crafty-controller**: container was permanently `unhealthy` → route withheld (`routeUnpublished`).
   Two independent healthcheck root causes, both fixed in one change: