feat(traefik): register traefik in manifest-driven secrets provisioning

secrets/secrets-map.yaml

@@ -1,22 +1,22 @@
-# ─────────────────────────────────────────────────────────────────────────────
+# ─────────────────────────────────────────────────────────────────────────
 # secrets-map.yaml — DATA-ONLY manifest for deploy/provision-stack.py
 #
 # RULES:
 #   - This file contains NO code, NO shell, NO secret values — only names.
 #   - Each stack entry declares:
 #       env_template:   repo path of the FULL env-file template (tracked).
-#                       The template is authoritative: the COMPLETE env file is
-#                       rendered from it on every provisioning run. Nothing is
-#                       line-edited in place, so keys can never silently go
-#                       missing.
+#                        The template is authoritative: the COMPLETE env file is
+#                        rendered from it on every provisioning run. Nothing is
+#                        line-edited in place, so keys can never silently go
+#                        missing.
 #       env_dest:       host path (relative to /volume1/docker/compose-files/)
-#                       the rendered env file is shipped to. Rendered file
-#                       exists ONLY on the host — never committed to git.
+#                        the rendered env file is shipped to. Rendered file
+#                        exists ONLY on the host — never committed to git.
 #       docker_secrets: map of docker-swarm-secret-name -> CI ENV VAR NAME
-#                       (Pattern C). The env var must be declared via
-#                       from_secret: in .woodpecker/deploy.yml's
-#                       provision-secrets step (Woodpecker v3 requires explicit
-#                       per-secret declaration; there is no expose-all).
+#                        (Pattern C). The env var must be declared via
+#                        from_secret: in .woodpecker/deploy.yml's
+#                        provision-secrets step (Woodpecker v3 requires explicit
+#                        per-secret declaration; there is no expose-all).
 #
 # ADDING A NEW SECRET (3 small steps, no shell edits):
 #   1. Add the secret value in Woodpecker UI (repo Settings -> Secrets).
@@ -27,7 +27,7 @@
 #
 # Stacks not listed here fall through to deploy.yml's legacy case-entries
 # untouched. Migration is deliberately one stack per PR.
-# ─────────────────────────────────────────────────────────────────────────────
+# ─────────────────────────────────────────────────────────────────────────
 stacks:
   ai:
     env_template: ai/ai.env.template
@@ -36,3 +36,6 @@ stacks:
       flowagent_azure_client_id: FLOWAGENT_AZURE_CLIENT_ID
       flowagent_azure_tenant_id: FLOWAGENT_AZURE_TENANT_ID
       flowagent_azure_client_secret: FLOWAGENT_AZURE_CLIENT_SECRET
+  traefik:
+    env_template: traefik/traefik.env.template
+    env_dest: traefik/traefik.env