docs: v0.83.0 REPORT/CONTEXT/README — scoped Traefik serversTransport for self-signed HTTPS backends

CONTEXT.md

@@ -7,7 +7,20 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-06-22 (v0.76.0 — campaign-#3 hardening: settings recovery, restore-name validation, quiesce-marker quarantine)
+Last updated: 2026-06-26 (v0.83.0 — Traefik scoped serversTransport for self-signed HTTPS backends; crafty 502 fix)
+
+> **2026-06-26 — v0.83.0 (deployed on 9201): scoped Traefik backend transport for self-signed HTTPS apps.**
+> Crafty is the **first/only catalog app with an HTTPS backend** (self-signed TLS on `:8443`, no plain-HTTP
+> port). The crafty healthcheck fix un-withheld its route, exposing a pre-existing 502 (Traefik proxied
+> HTTP to the HTTPS backend). Since traefik v3 forbids `insecureSkipVerify` via Docker labels, the
+> controller now renders a file-provider dynamic file `dynamic/serverstransports.yml` defining a **named**
+> `insecure-skip-verify` transport (`infra.RenderServersTransports` + `stacks.ensureServersTransports`,
+> written from `EnsureBaseStack` outside the traefik-running guard, write-if-changed, hot-loaded). Apps opt
+> in per-service via catalog labels `scheme=https` + `serverstransport=insecure-skip-verify@file`.
+> **No global `insecureSkipVerify`** — verification stays ON for every other backend (scoped Option B).
+> Pattern to reuse for any future self-signed HTTPS backend. Live-verified: `minecraft.demo-felhom.eu`
+> 502→302; filebrowser (HTTP) unaffected. Backlog: a `.felhom.yml backend_scheme` hint so the catalog
+> convention sets these labels instead of hand-adding.
 
 > **2026-06-22 — v0.76.0 (deployed on 9201): three campaign-#3 hardening fixes.**
 > - **S1**: corrupt `settings.json` no longer crash-loops — `save()` writes a last-known-good `.bak`