84c3e84641
traefik's websecure entrypoint now declares http.tls.domains *.<domain>+apex so it proactively obtains the wildcard via Cloudflare DNS-01 at startup (cert ready before first client, every router serves it by SNI). Gated on CFAPIToken (DNS-01). TraefikData gains Domain; ensureTraefik wires cfg.Customer.Domain. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>