infra: rongorongo state-sync backend + Traefik basicAuth

Add a Flask backend service for cross-device state persistence, storing
JSON state on an NFS volume at /mnt/docker-data/configs/rongorongo/data.
Frontend Dockerfile/nginx.conf reorganised into frontend/ subdirectory;
frontend API calls now route to /api/* handled by the backend container
over a dedicated bridge network. Traefik basicAuth middleware added to
the public URL with the bcrypt hash deliberately kept out of git
(REPLACE_AT_DEPLOY placeholder in rongorongo.yml). Prometheus probe moved
from https-external to internal http://192.168.86.192:8181/health to
bypass the new auth wall.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

compose/hf-pdocker-01/rongorongo/docker-compose.yml

@@ -1,17 +1,19 @@
 services:
-  rongorongo:
+  rongorongo-api:
     build:
-      context: .
+      context: ./backend
       dockerfile: Dockerfile
-    image: rongorongo:latest
-    container_name: rongorongo
+    image: rongorongo-api:latest
+    container_name: rongorongo-api
     restart: unless-stopped
-    ports:
-      - "8181:80"
-    mem_limit: 128M
-    memswap_limit: 128M
+    networks:
+      - rongorongo
+    volumes:
+      - /mnt/docker-data/configs/rongorongo/data:/data
+    mem_limit: 256M
+    memswap_limit: 256M
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost/health"]
+      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/health').status==200 else 1)"]
       interval: 30s
       timeout: 5s
       retries: 3
@@ -23,3 +25,36 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
+
+  rongorongo-web:
+    build:
+      context: ./frontend
+      dockerfile: Dockerfile
+    image: rongorongo-web:latest
+    container_name: rongorongo-web
+    restart: unless-stopped
+    depends_on:
+      - rongorongo-api
+    networks:
+      - rongorongo
+    ports:
+      - "8181:80"
+    mem_limit: 128M
+    memswap_limit: 128M
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+networks:
+  rongorongo:
+    driver: bridge