M1: Traefik swarm stack (wildcard cert via file provider); HTTPS path proven E2E

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

BACKLOG.md

@@ -16,7 +16,9 @@ Two single-writer sections (§6.1): Builder edits only `## Build backlog`; Adver
 ### M1 — Swarm + abra target
 - [x] Docker + single-node swarm via Nix (modules/swarm.nix: docker + swarm-init oneshot + `proxy`
       overlay net + daily autoprune). Verified: Swarm=active, proxy overlay present.
-- [ ] Traefik (file provider → /var/lib/ci-certs/live/) + per-run wildcard router
+- [x] Traefik (file provider → /var/lib/ci-certs/live/) as a swarm stack on `proxy`; wildcard cert
+      served as default cert. Verified end-to-end: gateway 143.244.213.108:443 SNI-passthrough →
+      cc-ci Traefik terminates TLS w/ `CN=*.ci.commoninternet.net` (LE E8), HTTP 404 (no router yet).
 - [ ] abra installed; deploy + tear down a trivial recipe by hand over HTTPS
 - [ ] Gate: M1 — recipe reachable over HTTPS at *.ci.commoninternet.net, torn down clean