asset-engine: drop traefik wiring, LAN-direct only

Internal tooling — accessed at http://10.250.50.70:8200, not through
Traefik. Removes the unused traefik labels (router rule, TLS, crowdsec
middleware, loadbalancer port) and the traefik-net network membership;
homepage.href now points at host:port for direct discovery, matching
task-board's pattern. Playbook verify drops the traefik-net membership
check.

playbooks/deploy-asset-engine.yaml

@@ -13,7 +13,6 @@
 #
 # Prereqs on the target host:
 #   - Docker + docker compose plugin
-#   - `traefik-net` docker network (external)
 #   - Target user (lkraven) has git SSH access to gitea.phasefinal.com
 #     — either SSH key authorized in gitea, or the repo is HTTPS-reachable
 #     if you swap `repo_url` below.
@@ -128,9 +127,3 @@ verify:
   - name: /health body reports status=ok
     shell: curl -sf http://localhost:{{ host_port }}/health | grep -q '"status"[[:space:]]*:[[:space:]]*"ok"'
     changed_when: "false"
-
-  - name: Container is in the traefik-net network
-    # `traefik-net` has a dash, so it's not accessible via Go template dot
-    # syntax — JSON-encode the networks map and grep for the key instead.
-    shell: docker inspect asset-engine --format '{{json .NetworkSettings.Networks}}' | grep -q traefik-net
-    changed_when: "false"