feat(B): Traefik deployment to all nodes during init/join (REQ-165, REQ-167)

- internal/traefik/install.go: shared Traefik installer (download +
  systemd unit + dynamic dir). Default v3.3.0, configurable.
- orca init: installs Traefik on localhost (idempotent, non-fatal
  if offline)
- proxmox bootstrap: installs Traefik on PVE host + downloads LXC
  template (default ubuntu-24.04, --lxc-template flag)
- linux bootstrap: installs Traefik on worker
- emitter/traefik.go: directory provider (was single file);
  register pve-ct/pve-vm in RegisterTraefik
- --lxc-template flag on node join (default ubuntu-24.04)

---ci---
project: orca
milestone: v0.12.18
phase: B
status: complete
requirements:
  covered: [165, 167]
---/ci---

internal/linux/bootstrap.go

@@ -34,6 +34,7 @@ import (
 	"git.cloudinit.dev/coreci/orca/internal/certpaths"
 	"git.cloudinit.dev/coreci/orca/internal/proxmox"
 	"git.cloudinit.dev/coreci/orca/internal/security"
+	"git.cloudinit.dev/coreci/orca/internal/traefik"
 )
 
 // DefaultSSHUser is the default SSH username for the initial connection.
@@ -156,6 +157,20 @@ func BootstrapLinux(ctx context.Context, opts Options) (*Result, error) {
 	}
 	opts.Logger.Info("linux bootstrap: user created", "user", opts.OrcaUser)
 
+	// Step 4d: Install Traefik on the remote host (REQ-165, Phase B).
+	// Traefik is the data-plane ingress; SSH is control plane only.
+	sshExecFn := func(cmd string) ([]byte, error) {
+		session, err := client.NewSession()
+		if err != nil {
+			return nil, err
+		}
+		defer session.Close()
+		return session.CombinedOutput(cmd)
+	}
+	if err := traefik.InstallRemote("", sshExecFn); err != nil {
+		opts.Logger.Warn("linux bootstrap: traefik install failed", "err", err)
+	}
+
 	// Step 5: Create the drift-events directory.
 	if err := sshExec(client, fmt.Sprintf(
 		"mkdir -p ~%s/drift-events && chown %s:%s ~%s/drift-events",