fix(auth): harden public infra routes

apps/traefik-dashboard/traefik-dashboard.yaml

@@ -20,10 +20,11 @@ metadata:
 spec:
   basicAuth:
     secret: traefik-dashboard-auth
----
-# Dashboard IngressRoute
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
+---
+# Internal-only route: if a public twin is ever operator-approved, gate it with Host(`<public-host>`) && (Method(`GET`) || Method(`HEAD`)).
+# Dashboard IngressRoute
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
 metadata:
   name: traefik-dashboard
   namespace: traefik-system