v0.41.1: wire the controller dashboard into traefik (felhom.<domain> routing)

EnsureBaseStack now writes a traefik file-provider route
(Host(felhom.<domain>) -> http://felhom-controller:8080) and joins the
controller to traefik-public. Done post-pull (domain known) and idempotently
(write-if-changed + skip-if-connected), so felhom.<domain> reaches the
controller. Completes the v0.41.0 base-infra bring-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/infra/infra_test.go

@@ -162,6 +162,23 @@ func TestCloudflaredRender(t *testing.T) {
 	}
 }
 
+func TestControllerRoute(t *testing.T) {
+	r := RenderControllerRoute("demo-felhom.eu")
+	if !strings.Contains(r, "Host(`felhom.demo-felhom.eu`)") {
+		t.Errorf("domain not wired into controller route rule: %q", r)
+	}
+	if !strings.Contains(r, "http://felhom-controller:8080") {
+		t.Errorf("controller service URL missing: %q", r)
+	}
+	if !strings.Contains(r, "websecure") {
+		t.Error("controller route must be on the websecure entrypoint")
+	}
+	var v any
+	if err := yaml.Unmarshal([]byte(r), &v); err != nil {
+		t.Fatalf("controller route is not valid YAML: %v\n%s", err, r)
+	}
+}
+
 func TestFileBrowserRender(t *testing.T) {
 	compose := RenderFileBrowserCompose("demo-felhom.eu", nil)
 	if !strings.Contains(compose, "Host(`files.demo-felhom.eu`)") {