--api.dashboard=true alone wasn't enough - the API returned 404 on every path after enabling it. Traefik apparently doesn't reliably auto-create the default "traefik" entrypoint the way older docs describe; defining it explicitly is the documented, reliable way to get the API/dashboard router actually listening. Still not in ports:, so still only reachable from other containers on falcon_network.