fix(infra): serve full TLS chain for epicnabbo.nl to resolve Cloudflare 525

Traefik's ACME resolver stored the epicnabbo.nl leaf certificate without
the Let's Encrypt intermediate. With Cloudflare in Full (strict) mode the
origin TLS handshake failed (HTTP 525), breaking every asset and the whole
site layout (JS/CSS chunks, Nitro client, toolbar).

Configure the epicnabbo router to use a file-based certificate that
includes the full chain (leaf + LE YR2 intermediate), referenced from
dynamic/epicnabbo-tls.yml. Add a regeneration script and README.

infra/traefik/dynamic/epicnabbo-tls.yml

@@ -0,0 +1,4 @@
+tls:
+  certificates:
+    - certFile: /etc/traefik/dynamic/epicnabbo-fullchain.pem
+      keyFile: /etc/traefik/dynamic/epicnabbo-key.pem

infra/traefik/dynamic/epicnabbo.nl.yml

@@ -0,0 +1,22 @@
+http:
+  routers:
+    epicnabbo:
+      entryPoints:
+        - websecure
+      rule: "Host(`epicnabbo.nl`) || Host(`www.epicnabbo.nl`)"
+      service: epicnabbo-svc
+      middlewares:
+        - default-security-headers
+      tls: {}
+
+  services:
+    epicnabbo-svc:
+      loadBalancer:
+        passHostHeader: true
+        serversTransport: epicnabbo-transport
+        servers:
+          - url: "https://172.21.0.1:9443"
+
+  serversTransports:
+    epicnabbo-transport:
+      insecureSkipVerify: true