Add websecure entrypoint with self-signed cert for Cloudflare Full SSL

Cloudflare Full SSL mode requires TLS on the origin. Added self-signed
cert to Traefik config and re-enabled websecure router without ACME
certresolver (Cloudflare handles public TLS, tunnel is already encrypted).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -21,6 +21,8 @@ services:
       - DAC_OVERRIDE
     security_opt:
       - no-new-privileges:true
+    ports:
+      - "8888:80"
     networks:
       - traefik-public
     labels: