asset-engine: drop traefik wiring, LAN-direct only

Internal tooling — accessed at http://10.250.50.70:8200, not through
Traefik. Removes the unused traefik labels (router rule, TLS, crowdsec
middleware, loadbalancer port) and the traefik-net network membership;
homepage.href now points at host:port for direct discovery, matching
task-board's pattern. Playbook verify drops the traefik-net membership
check.

stacks/asset-engine/README.md

@@ -7,8 +7,7 @@ over WG by default), and persists generated assets to a local SQLite
 DB + content-addressed blob store.
 
 **Server:** ana-docker
-**Hostname (TLS):** `asset-engine.phasefinal.com` (TLS via Traefik / `anaprod` cert resolver)
-**LAN port:** `10.250.50.70:8200` (configurable via `.env`)
+**URL:** `http://10.250.50.70:8200` (configurable via `.env`)
 **Upstream repo:** [vh/asset-engine](https://gitea.phasefinal.com/vh/asset-engine)
 **Image:** `asset-engine:local` — built on the host from the git repo by
 the deploy playbook. Not pulled from a registry.
@@ -55,14 +54,11 @@ scripts/elway ana-docker --playbook playbooks/deploy-asset-engine.yaml --var ref
 
 ## Network model
 
-Internal-only tool, two entry points:
-
-- **LAN**, default: `http://10.250.50.70:8200` — container port 8000
-  published on the host, bound to 0.0.0.0 (configurable via
-  `ASSET_ENGINE_BIND` / `ASSET_ENGINE_PORT`).
-- **TLS hostname**: `https://asset-engine.phasefinal.com` — Traefik on
-  ana-docker terminates TLS and forwards to the container over the
-  `traefik-net` docker network on port 8000.
+Internal tooling, LAN-only. Container port 8000 is published on the host
+at `0.0.0.0:8200` (configurable via `ASSET_ENGINE_BIND` /
+`ASSET_ENGINE_PORT`); access is direct via `http://10.250.50.70:8200`.
+No Traefik, no TLS terminator, no public hostname. If we later need
+TLS or external access, that's a separate decision.
 
 `INFERENCE_HOST` defaults to `10.100.79.3` (irv-ml1 over WG). Override
 in `.env` if the fleet's inference topology moves.