infra: rongorongo state-sync backend + Traefik basicAuth

Add a Flask backend service for cross-device state persistence, storing
JSON state on an NFS volume at /mnt/docker-data/configs/rongorongo/data.
Frontend Dockerfile/nginx.conf reorganised into frontend/ subdirectory;
frontend API calls now route to /api/* handled by the backend container
over a dedicated bridge network. Traefik basicAuth middleware added to
the public URL with the bcrypt hash deliberately kept out of git
(REPLACE_AT_DEPLOY placeholder in rongorongo.yml). Prometheus probe moved
from https-external to internal http://192.168.86.192:8181/health to
bypass the new auth wall.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

stacks/monitoring/prometheus.yml

@@ -70,6 +70,7 @@ scrape_configs:
         - http://192.168.86.192:9093        # Alertmanager
         - http://192.168.86.192:18795       # Spirit (infra ops agent)
         - http://192.168.86.192:8085        # VoiceCoach web client
+        - http://192.168.86.192:8181/health  # Rongorongo (probe internal — Traefik basicAuth blocks external)
         - http://192.168.86.192:7880        # VoiceCoach LiveKit server
     relabel_configs:
       - source_labels: [__address__]
@@ -153,7 +154,6 @@ scrape_configs:
         - https://vault.hobbs.farm         # Vaultwarden
         - https://git.hobbs.farm           # Gitea
         - https://coach.hobbs.farm         # VoiceCoach web client
-        - https://rongorongo.hobbs.farm    # Rongorongo decipherment engine
     relabel_configs:
       - source_labels: [__address__]
         target_label: __param_target