[ci skip] Fix HTTPS backend proxying for reverse-proxy services

- Add insecureSkipVerify=true globally for self-signed backend certs
- Name service ports with https- prefix for HTTPS backends so Traefik uses HTTPS
- Add ServersTransport CRD for per-service insecureSkipVerify
- Add serversscheme/serverstransport annotations to reverse-proxy factory

modules/kubernetes/traefik/main.tf

@@ -142,6 +142,8 @@ resource "helm_release" "traefik" {
       "--api.insecure=true",
       "--global.checknewversion=false",
       "--global.sendanonymoususage=false",
+      # Skip TLS verification for self-signed backend certs (proxmox, idrac, etc.)
+      "--serversTransport.insecureSkipVerify=true",
       # Increase timeouts for services like Immich
       "--serversTransport.forwardingTimeouts.dialTimeout=60s",
       "--serversTransport.forwardingTimeouts.responseHeaderTimeout=0s",