v0.41.1: wire the controller dashboard into traefik (felhom.<domain> routing)

EnsureBaseStack now writes a traefik file-provider route
(Host(felhom.<domain>) -> http://felhom-controller:8080) and joins the
controller to traefik-public. Done post-pull (domain known) and idempotently
(write-if-changed + skip-if-connected), so felhom.<domain> reaches the
controller. Completes the v0.41.0 base-infra bring-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,25 @@
 ## Changelog
 
+### v0.41.1 — wire the controller dashboard into traefik (`felhom.<domain>` routing) (2026-06-11)
+
+Completes v0.41.0: the base-infra bring-up stood up traefik/cloudflared/filebrowser but nothing routed
+the **controller itself** through traefik, so `felhom.<domain>` 404'd (live-confirmed: controller on
+`bridge` only, no traefik labels, empty `dynamic/`). filebrowser self-registers via Docker labels +
+network membership baked into its compose; the controller can't — it's started by the golden bootstrap
+*before* `traefik-public` exists, and the v2 `bootstrap.json` carries no domain (it comes from the hub
+pull). So the wiring must happen post-pull.
+
+- `infra.RenderControllerRoute(domain)` — a traefik file-provider dynamic route:
+  `Host(felhom.<domain>)` → `http://felhom-controller:8080` on websecure (`tls: {}` inherits the
+  entrypoint's default `letsencrypt` resolver when ACME is configured, else self-signed).
+- `EnsureBaseStack` now calls `wireController`: writes `dynamic/controller.yml` (write-if-changed, so the
+  traefik file watcher doesn't reload every health tick) and `docker network connect traefik-public
+  felhom-controller` (idempotent — skipped when already attached) so traefik can resolve the controller
+  by name. Runs on first boot and every self-heal tick. The Section-G shared `/opt/docker/stacks` mount
+  means traefik picks up the dynamic file live.
+- Diagnostic confirmed the tunnel chain was already healthy (token tunnel-id matches the DNS tunnel;
+  CF ingress `*.<domain> → https://traefik`); the only gap was this controller wiring.
+
 ### v0.41.0 — first-boot base-infrastructure bring-up + self-heal (+ Section-G mount fix) (2026-06-11)
 
 Lockstep with `felhom-agent` v0.20.0 + a golden rebake. A freshly-onboarded controller came up ONLINE