Camera cards using advanced-camera-card were stuck retrying WebRTC ICE negotiation every few seconds (visible as dashboards "refreshing"). frigate-nvr had no published ports at all, so go2rtc's WebRTC listener on 8555 was unreachable from browsers despite valid ICE candidates already configured (VIP + CIDR + stun) in frigate/config.yml. Publishing via ingress mode keeps this working regardless of which swarm node Frigate lands on (no placement constraint on this service). No Traefik/auth changes - HA<->Frigate signaling was already working correctly over traefik_backend; only the browser<->go2rtc media path was broken.