traefik: fix update order for host-mode/VRRP services (start-first -> stop-first)

reverse-proxy publishes host-mode ports (80/443/1883/5201/5431) — start-first
can never bind while the old task holds the ports, deadlocking every rolling
update. keepalived master/backup run VRRP on the host network — concurrent
old+new speakers with the same router-id risk VIP flapping. Both now use
stop-first (global mode + parallelism=1 + VIP failover keeps ingress up).
Stateless helpers (whoami, speedtest, iperf3, certs-dumper) keep start-first.

Step 1 of Tier 0/1 pipeline inclusion (prep for removing traefik/woodpecker
from the bootstrap manual-deploy guard).

traefik.yaml

@@ -20,16 +20,18 @@ services:
       labels: [traefik.enable=false]
       resources:
         limits: {cpus: '1', memory: 128M}
+      # stop-first: host network + VRRP — two concurrent keepalived speakers with the
+      # same router-id would fight over the VIP. Never run old+new simultaneously.
       update_config:
         parallelism: 1
         delay: 30s
         failure_action: rollback
         monitor: 15s
-        order: start-first
+        order: stop-first
       rollback_config:
         parallelism: 1
         failure_action: pause
-        order: start-first
+        order: stop-first
 
   keepalived-backup:
     environment:
@@ -51,16 +53,17 @@ services:
       labels: [traefik.enable=false]
       resources:
         limits: {cpus: '1', memory: 128M}
+      # stop-first: host network + VRRP (see keepalived-master)
       update_config:
         parallelism: 1
         delay: 30s
         failure_action: rollback
         monitor: 15s
-        order: start-first
+        order: stop-first
       rollback_config:
         parallelism: 1
         failure_action: pause
-        order: start-first
+        order: stop-first
 
   reverse-proxy:
     image: public.ecr.aws/docker/library/traefik:latest
@@ -128,16 +131,20 @@ services:
         - traefik.http.routers.traefik.middlewares=forwardAuth-authentik@file, crowdsec@file
       resources:
         limits: {cpus: '4', memory: 512M}
+      # stop-first: host-mode published ports (80/443/1883/5201/5431) — a start-first
+      # replacement task can never bind while the old task holds the ports, so
+      # start-first would deadlock/rollback every update. Global mode + parallelism 1
+      # means only one node is briefly down; keepalived VIP + remaining nodes cover it.
       update_config:
         parallelism: 1
         delay: 30s
         failure_action: rollback
         monitor: 15s
-        order: start-first
+        order: stop-first
       rollback_config:
         parallelism: 1
         failure_action: pause
-        order: start-first
+        order: stop-first
 
   traefik-certs-dumper:
     image: ghcr.io/ldez/traefik-certs-dumper:v2.10.0