Harden routing, add Keel, set image policy

[jorisjonkers-dev-agents]

Context. Post-cutover polish for the edge + image lifecycle.

Steps

• Review Traefik IngressRoute/Middleware (regex routing) for least-privilege + TLS; tighten as needed.
• Decide & configure Keel (or chosen controller) for automated image updates where wanted.
• Set the :latest / pinned-tag policy explicitly per workload class.

Acceptance

• Routing reviewed + hardened; image-update policy documented and enforced.