Add Traefik reverse-proxy module

[RonaldHensbergen]

Summary

Adds a new modules/integration/traefik/module.yaml defining a Traefik
reverse-proxy module:

• Container runtime exposing http/https/dashboard ports.
• Configurable logging, access logs, API/dashboard, entry points, TLS
  (min/max version, SNI strictness, preferred server cipher suites), Docker
  provider, and file provider settings, all with sane secure defaults
  (TLS 1.2+ enforced, dashboard bound to 127.0.0.1, insecure API off).
• Provides a reverse-proxy contract over HTTPS on port 443.
• Hardened Compose implementation: non-root user, read_only root FS,
  cap_drop: [ALL], no-new-privileges, pids_limit, and a
  traefik healthcheck --ping healthcheck.

Refs #205 (TLS and certificate-management contracts) — this module is the
ingress/reverse-proxy piece that will carry TLS termination and
certificate-reference wiring for that work.

Testing

• cds validate (standalone single-module profile) — 0 diagnostics.
• yamllint modules/integration/traefik/module.yaml — clean.