add system and traefik widgets to pulsenode; enable Traefik API

- traefik/compose.yml: flip --api.dashboard=true so Traefik's internal
  API is reachable. No entrypoint named "traefik" is defined, so
  Traefik auto-creates its default one on :8080 - not published to the
  host (only 80/443 are), so it's reachable only from other containers
  on falcon_network, i.e. exactly (and only) pulsenode.
- pulsenode/config.yml: adds a system widget and swaps the plain
  Traefik docker card for the real traefik widget (router/entrypoint/
  middleware view via that now-enabled API), both at the top of
  Services.

Verified locally before deploying: a plain container (no pid: host,
no /proc,/sys mounts) already reports host-accurate CPU count, memory
total, and root disk usage via systeminformation, since Docker doesn't
namespace /proc/stat, /proc/meminfo, or overlayfs df by default. No
privilege escalation needed for the system widget after all - tested
side by side against the real host's nproc/free/df output. Also
confirmed the merged config.yml validates against the app's own zod
schema, not just as YAML.

pulsenode/config/config.yml

@@ -7,14 +7,13 @@ theme:
 groups:
   - name: Services
     widgets:
-      - type: docker
+      - type: system
+        interval: 5s
+
+      - type: traefik
         name: Traefik
-        containerName: traefik
-        icon: traefik
-        interval: 10s
-        # No href: the dashboard is disabled (--api.dashboard=false).
-        # Swap for a `traefik` widget (router/entrypoint/middleware view)
-        # if the API gets enabled - see Traefik's --api.dashboard docs.
+        apiUrl: http://traefik:8080/api
+        interval: 15s
 
       - type: docker
         name: Coolify