streamline traefik dashboard routing: docker labels instead of file provider

Switches traefik.pivoine.art routing from a standalone file-provider
router (dynamic/dashboard.yaml) to docker-compose labels on traefik's
own service - the same pattern every other stack already uses for its
own routing, rather than a one-off exception. Traefik discovers itself
just like any other container on falcon_network. Both routers point
at the built-in api@internal service via .service= instead of a
loadbalancer target, since there's no backend container port to route
to. Also dropped the (PathPrefix(`/api`) || PathPrefix(`/dashboard`))
condition - the whole traefik.pivoine.art host is dedicated to this,
so a bare Host() match is simpler and no less correct.

Also fixes why VPN access still failed: traefik.pivoine.art was never
added to Headscale's MagicDNS extra_records, so even a tailnet-
connected browser resolved it via public DNS and hit vpn-only from a
non-tailnet source IP - same root cause as the earlier
pulsenode.pivoine.art fix, just missed for this hostname.

traefik/dynamic/dashboard.yaml

@@ -1,32 +0,0 @@
-# Exposes Traefik's own API/dashboard (api@internal is a built-in service,
-# not something defined below) on traefik.pivoine.art, gated by vpn-only.
-# Path prefixes match Traefik's own documented self-referencing pattern:
-# /api serves the JSON pulsenode's traefik widget reads, /dashboard serves
-# the browsable UI.
-http:
-  middlewares:
-    traefik-redirect-web-secure:
-      redirectScheme:
-        scheme: https
-
-  routers:
-    traefik-dashboard-web:
-      rule: "Host(`traefik.pivoine.art`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
-      entrypoints:
-        - web
-      middlewares:
-        - vpn-only@file
-        - traefik-redirect-web-secure
-      service: api@internal
-
-    traefik-dashboard-web-secure:
-      rule: "Host(`traefik.pivoine.art`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
-      entrypoints:
-        - web-secure
-      tls:
-        certResolver: resolver
-      middlewares:
-        - vpn-only@file
-        - security-headers@file
-        - no-index@file
-      service: api@internal