fix(deploy): use file-provider router instead of docker labels

The docker-label router (apess-web@docker) was being silently dropped
by Traefik after subsequent reloads, even though all labels and the
container's network attach were correct. Falling back to the
ClawBooks landing's catch-all PathPrefix(`/`) meant apess.redclaw.dev
served the wrong content after the first ~5 minutes.

Switch to an explicit file-provider definition in apess.yml with
priority: 1000 (well above landing's priority: 1) so the router is
authoritative regardless of docker-discovery races. The compose file
now just runs the container; routing is owned by the dynamic config.

deploy/docker-compose.yml

@@ -10,14 +10,8 @@ services:
     restart: unless-stopped
     networks:
       - clawbooks-net
-    labels:
+    # Routing is defined in deploy/traefik/apess.yml (file provider) to avoid
-      - traefik.enable=true
+    # docker-label discovery races with the neighboring ClawBooks stack.
-      - traefik.docker.network=clawbooks-net
-      - traefik.http.routers.apess-web.rule=Host(`apess.redclaw.dev`)
-      - traefik.http.routers.apess-web.entrypoints=websecure
-      - traefik.http.routers.apess-web.tls=true
-      - traefik.http.routers.apess-web.service=apess-web
-      - traefik.http.services.apess-web.loadbalancer.server.port=80
 
 networks:
   clawbooks-net:

deploy/traefik/apess.yml

@@ -1,8 +1,23 @@
-# APESS 2026 — Cloudflare Origin Certificate (*.redclaw.dev)
+# APESS 2026 — Traefik dynamic config (file provider)
-# Drop this file into the live Traefik dynamic dir on gw-03:
+# Lives at /home/redclaw/projects/clawbooks/deploy/traefik/dynamic/apess.yml on gw-03.
-#   /home/redclaw/projects/clawbooks/deploy/traefik/dynamic/apess.yml
+# Cert: /etc/traefik/ssl/apess/apess.{pem,key} (Cloudflare Origin Cert *.redclaw.dev)
-# Cert files must live alongside the existing gw03/ + origin/ certs at:
+# Service backend: apess-web container on clawbooks-net (port 80)
-#   /home/redclaw/projects/clawbooks/deploy/traefik/ssl/apess/apess.{pem,key}
+http:
+  routers:
+    apess-web:
+      rule: "Host(`apess.redclaw.dev`)"
+      entryPoints:
+        - websecure
+      service: apess-web
+      tls: {}
+      priority: 1000
+
+  services:
+    apess-web:
+      loadBalancer:
+        servers:
+          - url: "http://apess-web:80"
+
 tls:
   certificates:
     - certFile: /etc/traefik/ssl/apess/apess.pem