Configure Traefik for public-facing access with frostlabs.me domains

- Fixed certificatesResolvers configuration in static.yml (moved out of tls section)
- Added DNS resolvers to Cloudflare ACME challenge configuration
- Added persistent volume mount for Let's Encrypt certificates
- Updated Outline service labels to use flow.frostlabs.me with proper cert resolver
- Updated Authentik service labels to use auth.frostlabs.me with proper cert resolver
- Added security headers and rate limiting middlewares to dynamic.yml
- Added example templates for public-facing service configuration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

stacks/apps/outline/stack.yml

@@ -40,9 +40,11 @@ services:
       labels:
       - "traefik.enable=true"
       - "traefik.swarm.network=homelab"
-      - "traefik.http.routers.outline.rule=Host(`flow.swarm.home`)"
+      # Public-facing domain with Let's Encrypt certificate
+      - "traefik.http.routers.outline.rule=Host(`flow.frostlabs.me`)"
       - "traefik.http.routers.outline.entrypoints=websecure"
       - "traefik.http.routers.outline.tls=true"
+      - "traefik.http.routers.outline.tls.certresolver=cloudflare"
       - "traefik.http.services.outline.loadbalancer.server.port=3000"
     depends_on:
     - redis