M1: proxy via real coop-cloud/traefik (abra, wildcard/no-ACME); recipe deploy+teardown; M1 CLAIMED

Orchestrator decision: deploy canonical coop-cloud traefik via abra instead of a
hand-rolled module. abra packaged in Nix (pinned). custom-html deployed over HTTPS
(200) via the gateway and torn down clean. docs/install.md seeded.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -10,6 +10,28 @@ Architecture decisions and dead-ends. One line of rationale each. (§0, §8)
 - **Git credentials:** helper script in repo-local git config sources `/srv/cc-ci/.testenv` at call
   time — no secret values stored in `.git/config` or commits.
 
+- **Proxy: real coop-cloud/traefik via abra — SETTLED (M1, orchestrator decision 2026-05-26,
+  overrides plan §3 `modules/traefik.nix`).** Instead of a hand-rolled Traefik we deploy the
+  canonical Co-op Cloud `traefik` recipe via abra in **wildcard / file-provider mode**, for
+  end-to-end fidelity (canonical `web`/`web-secure` entrypoints + proxy/swarm conventions every
+  recipe expects — this also fixed an entrypoint-name mismatch the custom build hit). NO ACME, NO
+  DNS token on the box:
+  - `WILDCARDS_ENABLED=1` + append `compose.wildcard.yml`; the pre-issued cert is fed as the
+    `ssl_cert`/`ssl_key` swarm secrets (v1) via `abra app secret insert … -f` from
+    `/var/lib/ci-certs/live/{fullchain,privkey}.pem`. The file provider serves it (`tls.certificates`).
+  - `LETS_ENCRYPT_ENV=` **empty** on the traefik app *and* on every test app → the recipe's
+    `tls.certresolver=${LETS_ENCRYPT_ENV}` label resolves to no resolver → routers serve the
+    wildcard via SNI from the file provider, ACME never fires. (Verified: 0 ACME log lines.)
+  - Reproducibility (D8): `scripts/deploy-proxy.sh` is idempotent (ensures local abra server, fetches
+    recipe, writes the wildcard/no-ACME env, inserts cert secrets, deploys). Documented in
+    `docs/install.md`. The custom `modules/traefik.nix` was removed; `modules/swarm.nix` keeps swarm
+    init + `proxy` net + firewall 80/443.
+  - **Renewal (manual, ~90d):** operator re-issues the wildcard at the same paths, then
+    `abra app secret rm traefik.ci.commoninternet.net ssl_cert -n` + re-insert at a new version (bump
+    `SECRET_WILDCARD_CERT_VERSION`) and redeploy. (Documented in docs/secrets.md at M7.)
+  - **abra teardown syntax** (for harness, §4.3): `abra app undeploy <d> -n`,
+    `abra app volume remove <d> -f -n`, `abra app secret remove <d> --all -n`. None take `--chaos`.
+
 ## Open (defaults from §8, to confirm as reality lands)
 
 - **Deploy mechanism — SETTLED (M0):** `nixos-rebuild switch --flake /root/cc-ci#cc-ci` run *on