streamline traefik dashboard routing: docker labels instead of file provider

Switches traefik.pivoine.art routing from a standalone file-provider
router (dynamic/dashboard.yaml) to docker-compose labels on traefik's
own service - the same pattern every other stack already uses for its
own routing, rather than a one-off exception. Traefik discovers itself
just like any other container on falcon_network. Both routers point
at the built-in api@internal service via .service= instead of a
loadbalancer target, since there's no backend container port to route
to. Also dropped the (PathPrefix(`/api`) || PathPrefix(`/dashboard`))
condition - the whole traefik.pivoine.art host is dedicated to this,
so a bare Host() match is simpler and no less correct.

Also fixes why VPN access still failed: traefik.pivoine.art was never
added to Headscale's MagicDNS extra_records, so even a tailnet-
connected browser resolved it via public DNS and hit vpn-only from a
non-tailnet source IP - same root cause as the earlier
pulsenode.pivoine.art fix, just missed for this hostname.

traefik/compose.yml

@@ -40,6 +40,19 @@ services:
       timeout: 5s
       retries: 3
       start_period: 10s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${NETWORK_NAME}"
+      - "traefik.http.middlewares.traefik-redirect-web-secure.redirectscheme.scheme=https"
+      - "traefik.http.routers.traefik-dashboard-web.rule=Host(`traefik.pivoine.art`)"
+      - "traefik.http.routers.traefik-dashboard-web.entrypoints=web"
+      - "traefik.http.routers.traefik-dashboard-web.middlewares=traefik-redirect-web-secure"
+      - "traefik.http.routers.traefik-dashboard-web.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard-web-secure.rule=Host(`traefik.pivoine.art`)"
+      - "traefik.http.routers.traefik-dashboard-web-secure.entrypoints=web-secure"
+      - "traefik.http.routers.traefik-dashboard-web-secure.tls.certresolver=resolver"
+      - "traefik.http.routers.traefik-dashboard-web-secure.middlewares=vpn-only@file,security-headers@file,no-index@file"
+      - "traefik.http.routers.traefik-dashboard-web-secure.service=api@internal"
     networks:
       - compose_network
       - coolify_network