Gate the VPS instance behind Traefik basic auth until Phase 16

Petal authenticates nobody yet -- StaticResolver hands every request the
same local user -- so on a public host the whole API is open: anyone who
finds the hostname can read and write documents and fill the disk with
image uploads. Traefik holds the door until the OIDC flow exists.

/api/health keeps its own higher-priority router with no middleware, so
the acceptance criterion (public health endpoint, reachable by the
monitoring on this box) still holds. Both the middleware and that router
are deleted when Phase 16 lands.

deploy/petal.env.example

@@ -20,6 +20,14 @@ TZ=Europe/Lisbon
 PETAL_UID=1001
 PETAL_GID=1001
 
+# --- Interim edge gate (delete when Phase 16 auth lands) ---------------------
+# Petal has no authentication of its own yet — StaticResolver hands every
+# request the same local user — so Traefik holds the door with basic auth until
+# the OIDC flow exists. user:bcrypt-hash, as produced by:
+#   htpasswd -nbB petal 'your-password'
+# /api/health is deliberately exempt (its own router) so monitoring still works.
+PETAL_BASIC_AUTH=
+
 # --- LLM (millenia, over headscale) ------------------------------------------
 # The only cross-VPN dependency. Petal degrades warmly when it's unreachable:
 # spell check, gloss, garden, search, export and read-aloud all keep working and