feat(nodes): remote ingress via Traefik file provider

Remote replicas publish an ephemeral host port; the agent reports the
assigned binding back in the create_container result and the backend
renders a per-service file-provider config into TRAEFIK_DYNAMIC_DIR
pointing Traefik at the node's mesh IP + port. Routes are rewritten on
every remote reconcile and removed on teardown or local placement.

Also: RetireService retires remote leftovers when a service returns to
local placement; remove_container is idempotent agent-side; tombstoned
replicas skip remove dispatch; the domains-stay-local ceiling is gone.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/guides/CLI.md

@@ -161,10 +161,12 @@ containr nodes update <id> --tags gpu,eu-west
 containr services update <id> --placement-tags gpu     # only gpu nodes are eligible
 ```
 
-Remote nodes run registry-pulled images only — git builds, domains
-(Traefik lives on the host), and sleep detection stay local. Start,
-stop, restart, redeploy, and delete all fan out to the pinned node's
-agent. `services get` shows the resolved `node_name`.
+Remote nodes run registry-pulled images only — git builds and sleep
+detection stay local. Domains work remotely: the agent publishes the
+service port and the backend writes a Traefik file-provider route to the
+node's mesh IP (TRAEFIK_DYNAMIC_DIR — wired by the infra compose).
+Start, stop, restart, redeploy, and delete all fan out to the pinned
+node's agent. `services get` shows the resolved `node_name`.
 
 Take a node out of rotation or empty it entirely (admin):