infra: rongorongo state-sync backend + Traefik basicAuth

Add a Flask backend service for cross-device state persistence, storing
JSON state on an NFS volume at /mnt/docker-data/configs/rongorongo/data.
Frontend Dockerfile/nginx.conf reorganised into frontend/ subdirectory;
frontend API calls now route to /api/* handled by the backend container
over a dedicated bridge network. Traefik basicAuth middleware added to
the public URL with the bcrypt hash deliberately kept out of git
(REPLACE_AT_DEPLOY placeholder in rongorongo.yml). Prometheus probe moved
from https-external to internal http://192.168.86.192:8181/health to
bypass the new auth wall.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

stacks/traefik/dynamic/rongorongo.yml

@@ -5,6 +5,7 @@ http:
       entryPoints:
         - websecure
       middlewares:
+        - rongorongo-auth
         - security-headers
       service: rongorongo
       tls:
@@ -21,6 +22,12 @@ http:
       redirectScheme:
         scheme: https
         permanent: true
+    rongorongo-auth:
+      basicAuth:
+        realm: "rongorongo.hobbs.farm"
+        # users entries are appended at deploy time as: <user>:<bcrypt-hash>
+        users:
+          - "REPLACE_AT_DEPLOY"
   services:
     rongorongo:
       loadBalancer: