v0.42.0: real Let's Encrypt cert via wildcard proactive issuance

traefik's websecure entrypoint now declares http.tls.domains *.<domain>+apex so
it proactively obtains the wildcard via Cloudflare DNS-01 at startup (cert ready
before first client, every router serves it by SNI). Gated on CFAPIToken (DNS-01).
TraefikData gains Domain; ensureTraefik wires cfg.Customer.Domain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/stacks/infra.go

@@ -92,6 +92,7 @@ func (m *Manager) ensureTraefik(dir string) error {
 		return fmt.Errorf("chmod acme.json: %w", err)
 	}
 	files, err := infra.RenderTraefik(infra.TraefikData{
+		Domain:     m.cfg.Customer.Domain,
 		ACMEEmail:  m.cfg.Customer.Email,
 		CFAPIToken: m.cfg.Infrastructure.CFAPIToken,
 	})