docs: add Traefik reverse proxy examples (labels and file provider) to all READMEs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -147,7 +147,9 @@ docker compose start backend
 
 ### HTTPS
 
-This application does not terminate TLS. For production use, place it behind a reverse proxy that handles HTTPS:
+This application does not terminate TLS. For production use, place it behind a reverse proxy that handles HTTPS.
+
+#### Nginx
 
 ```nginx
 server {
@@ -167,6 +169,54 @@ server {
 }
 ```
 
+#### Traefik — Docker labels
+
+Add these labels to the `frontend` service and connect it to the network shared with Traefik:
+
+```yaml
+# docker-compose.override.yml
+services:
+  frontend:
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.inventory.rule=Host(`inventory.example.com`)"
+      - "traefik.http.routers.inventory.entrypoints=websecure"
+      - "traefik.http.routers.inventory.tls.certresolver=letsencrypt"
+      - "traefik.http.services.inventory.loadbalancer.server.port=8080"
+    networks:
+      - internal
+      - traefik_public  # network shared with your Traefik instance
+
+networks:
+  traefik_public:
+    external: true
+```
+
+#### Traefik — Dynamic configuration (file provider)
+
+If Traefik is not running in Docker (or you prefer the file provider), drop a file in your dynamic config directory:
+
+```yaml
+# /etc/traefik/dynamic/inventory.yml
+http:
+  routers:
+    inventory:
+      rule: "Host(`inventory.example.com`)"
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+      service: inventory-svc
+
+  services:
+    inventory-svc:
+      loadBalancer:
+        servers:
+          - url: "http://127.0.0.1:8080"
+```
+
+Traefik picks up the file automatically — no restart required.
+
 For local-only use, bind to loopback to prevent accidental LAN exposure:
 
 ```yaml