infra: rongorongo state-sync backend + Traefik basicAuth

Add a Flask backend service for cross-device state persistence, storing
JSON state on an NFS volume at /mnt/docker-data/configs/rongorongo/data.
Frontend Dockerfile/nginx.conf reorganised into frontend/ subdirectory;
frontend API calls now route to /api/* handled by the backend container
over a dedicated bridge network. Traefik basicAuth middleware added to
the public URL with the bcrypt hash deliberately kept out of git
(REPLACE_AT_DEPLOY placeholder in rongorongo.yml). Prometheus probe moved
from https-external to internal http://192.168.86.192:8181/health to
bypass the new auth wall.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -35,7 +35,7 @@ hf-pdocker-01 (23GB RAM, i7-7700T, NVMe, HD 630 GPU) -- RESTORED (2026-03-08, ha
 ├── [COMPOSE] Monitoring (Grafana :3001, Prometheus :9095, Alertmanager :9093, InfluxDB :8086, Blackbox :9115, matrix-receiver :9094)
 ├── [COMPOSE] Farm Manager API (:8888) -- dashboard + API server
 ├── [COMPOSE] Farm Agent (:8889)
-├── [COMPOSE] Rongorongo (:8181) -- static HTML/JS decipherment engine (Anthropic API direct from browser)
+├── [COMPOSE] Rongorongo decipherment engine -- 2 containers (rongorongo-web :8181, rongorongo-api). Server-synced state at /mnt/docker-data/configs/rongorongo/data. Traefik basicAuth on rongorongo.hobbs.farm.
 ├── [REMOVED] VoiceCoach -- moved to GPU machine (192.168.86.150) 2026-04-04
 ├── [COMPOSE] Node-exporter (:9100) -- standalone with pid:host
 ├── [COMPOSE] Telegraf -- metrics collection to InfluxDB
@@ -164,7 +164,7 @@ compose/             # Standalone Compose definitions (deployed per-node)
 - AI Agents (margaret :18790, spirit :18795 [infra ops — monitors #notifications, auto-remediates alerts]) -- LAN-accessible (bind=lan, 0.0.0.0)
 - Farm Manager: :8888 (dashboard + API)
 - Farm Agent: :8889
-- Rongorongo: :8181 (web at rongorongo.hobbs.farm)
+- Rongorongo: :8181 (rongorongo-web nginx; reverse-proxies /api/* to rongorongo-api Flask backend on the internal `rongorongo` bridge net). State + images at /mnt/docker-data/configs/rongorongo/data/. Public URL gated by Traefik basicAuth (creds in Vaultwarden).
 - ~~VoiceCoach~~ -- moved to GPU machine (192.168.86.150) 2026-04-04
 
 **hf-pdocker-02 (192.168.86.100):**