add system and traefik widgets to pulsenode; enable Traefik API

- traefik/compose.yml: flip --api.dashboard=true so Traefik's internal
  API is reachable. No entrypoint named "traefik" is defined, so
  Traefik auto-creates its default one on :8080 - not published to the
  host (only 80/443 are), so it's reachable only from other containers
  on falcon_network, i.e. exactly (and only) pulsenode.
- pulsenode/config.yml: adds a system widget and swaps the plain
  Traefik docker card for the real traefik widget (router/entrypoint/
  middleware view via that now-enabled API), both at the top of
  Services.

Verified locally before deploying: a plain container (no pid: host,
no /proc,/sys mounts) already reports host-accurate CPU count, memory
total, and root disk usage via systeminformation, since Docker doesn't
namespace /proc/stat, /proc/meminfo, or overlayfs df by default. No
privilege escalation needed for the system widget after all - tested
side by side against the real host's nproc/free/df output. Also
confirmed the merged config.yml validates against the app's own zod
schema, not just as YAML.

traefik/compose.yml

@@ -3,7 +3,7 @@ services:
     image: traefik:v3
     container_name: traefik
     command:
-      - "--api.dashboard=false"
+      - "--api.dashboard=true"
       - "--ping=true"
       - "--log.level=INFO"
       - "--accesslog=true"