fix(traefik): use Host() instead of HostRegexp for dashboard router (v3 prep)

[ClaydeCode]

What

The shard's generated Traefik dynamic config routes the dashboard with a literal subdomain rule, but used HostRegexp(traefik.) — which is v2-only rule syntax. Switch it to Host().

Why

This is prep for the planned Traefik v2.6 → v3 upgrade (the fd-exhaustion / EMFILE fix — old traefik builds (Go <1.19) can't self-raise their nofile ceiling; v3 can). Under Traefik v3's default v3 rule syntax, HostRegexp is interpreted as a Go regexp, so the literal . in traefik.<domain> would match any character (over-broad match). Host() with the literal hostname matches identically under both v2 and v3, so this is a no-op on the current v2.6 and correct on v3.

It is the only v2-only rule the generator emits — every other rule already uses Host(), HostSNI(), or literal PathPrefix(), all of which are v2/v3-identical.

Risk / testing

• No behavioural change on the deployed v2.6.
• tests/test_traefik_dyn_spec.py passes.
• Surgical one-line change (+ explanatory comment).

Context

Part of the traefik-v3 hardening from the shard-333 EMFILE investigation. Companion changes: controller-ingress hardening (freeshard-controller) and a new shard core-version pinning traefik:v3 (blocked on this + the azure→azuredns ACME provider migration + a core image release carrying #108).

🤖 Generated with Claude Code

[ClaydeCode]

Dropping per decision: we're staying on Traefik 2 (bumping to v2.11, which is Go 1.25 and self-raises nofile — the actual root cause). HostRegexp keeps working under v2 syntax, so this change isn't needed now. Folded into a Traefik v3 migration backlog ticket instead.