opencode UI route via traefik labels on a swarm relay, not the file-directory provider

Enabling FILE_PROVIDER_DIRECTORY_ENABLED in the coop-cloud traefik recipe
REPLACES its single provider file (wildcard cert + `security` middleware),
which took every cc-ci front door down for two minutes on 2026-09-07.
Reverted. The route is now what every recipe does: a one-container swarm
stack (`opencode-ui`, alpine/socat relay to nginx on the docker bridge)
carrying the traefik router labels, deployed by opencode-ui-route.service.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

README.md

@@ -158,9 +158,12 @@ Everything in this section is **outside git**. Do it as root over SSH, in this o
 
 The combined host is NOT on the tailnet (operator decision 2026-09-07): ssh is key-only on the
 public IP, the CI front doors are public via traefik, and the opencode UI is public on the same
-443 — traefik routes `oc.ci.commoninternet.net` (a dynamic-config file that
-`opencode-ui-route.service` drops into the traefik stack's file-providers volume) to an nginx
-vhost on the docker bridge that enforces basic auth. fail2ban guards sshd and that login
+443 — traefik routes `oc.ci.commoninternet.net` to an nginx vhost on the docker bridge that
+enforces basic auth, via traefik labels on a tiny swarm relay stack (`opencode-ui`) that
+`opencode-ui-route.service` deploys. (Not via traefik's file *directory* provider: enabling
+that in the coop-cloud traefik recipe REPLACES its provider file, which holds the wildcard cert
+and the `security` middleware, and every front door goes down — it did, for two minutes, on
+2026-09-07.) fail2ban guards sshd and that login
 (`nix/hosts/cc-ci/configuration.nix`; the nginx jail bans in the DOCKER-USER chain because the
 traffic is docker-forwarded, not host INPUT).