Document the real bus.saillant.cc exposure chain (cloudflared -> Traefik -> Tower nginx pinned by digest) now that Task 7 hosting and Task 8 deploy.sh have been validated end-to-end.