feat: keep local Traefik config in untracked traefik/dynamic.d

[yepzdk]

Tools such as Agent Proxy write API keys into Traefik's dynamic config. The only place for local config was the tracked traefik/dynamic-conf.yaml, so a git commit -a would publish those keys to this public repository.

traefik/dynamic.d/ is now Traefik's /config and ignored by git. The shared dynamic-conf.yaml is mounted into it at the same container path, so it loads and live-reloads as before. Local services go in dynamic.d/, one file each.

The local directory has to be /config itself: Traefik's file provider reads subdirectories but only watches top-level files, so a /config/local mount would not reload. dynamic.d/dynamic-conf.yaml is an empty placeholder Docker needs as the mount point while /config is read-only.

Existing setups keep working after itkdev-docker-compose traefik:start. Services already added to dynamic-conf.yaml should be moved to dynamic.d/, not copied: Traefik drops a router or middleware defined twice with different content.