fix: catch-all middleware allow localhost for healthcheck, drop certresolver

CatchAllMiddleware was intercepting Docker healthcheck requests (Host:
localhost) and internal API calls, returning 404 instead of passing
through. Also removed certresolver from catch-all Traefik router to
avoid cert provisioning issues with HostRegexp(.+).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/web/server.go

@@ -295,7 +295,9 @@ func (s *Server) CatchAllMiddleware(next http.Handler) http.Handler {
 		if idx := strings.LastIndex(host, ":"); idx != -1 {
 			host = host[:idx]
 		}
-		if strings.EqualFold(host, controllerHost) || host == "" {
+		// Pass through: controller host, localhost (healthcheck/internal), or empty
+		if strings.EqualFold(host, controllerHost) || host == "" ||
+			host == "localhost" || host == "127.0.0.1" {
 			next.ServeHTTP(w, r)
 			return
 		}