feat(traefik): Routers widget shows current routers only, one header row, certs on the routers they serve (#5254)

#5254 "Traefik — Routers: current routers only, header row, certs on the router they serve".

- Router hosts come from Traefik's API (/api/http|tcp/routers), read
  best-effort on each scrape. An optional api_url overrides it; the default
  is /api on the metrics host. A certificate's expiry then shows in a TLS
  column on the router whose host it covers. An expiring one makes that
  router a problem, graded by Settings → Thresholds.
- Only current: routers and certificates must have appeared in the last
  three scrapes. Certificates are upserted by serial and never deleted, so
  renewed or retired ones lingered on the widget.
- Widget order: verdict, problem routers with the reason, then the busiest
  healthy routers under one header (Router / Req/s / Bandwidth / p95 / TLS).
  A missing value shows "—".
- If the API is unreachable, expiring certificates are listed after the
  routers, not above them.
- The page splits certificates into served (with the routers using each,
  plus SANs) and "No longer served".
- Latest row per router: an index walk (recursive CTE + LATERAL) replaces
  DISTINCT plus a query per router.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_traefik_latest.py

@@ -0,0 +1,46 @@
+"""Integration: the newest Traefik row per router, read by walking the
+(router_name, scraped_at) index rather than grouping every row (#5254).
+Requires STEWARD_DATABASE_URL."""
+from __future__ import annotations
+
+import asyncio
+import os
+import uuid
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture
+def app():
+    if not os.environ.get("STEWARD_DATABASE_URL"):
+        pytest.skip("needs Postgres")
+    from steward.app import create_app
+    return create_app(testing=False)
+
+
+def test_each_router_reads_as_its_newest_row(app):
+    from plugins.traefik.models import TraefikMetric
+    from plugins.traefik.routes import latest_per_router
+
+    now = datetime.now(timezone.utc).replace(microsecond=0)
+    tag = uuid.uuid4().hex[:8]
+    a, b = f"a-{tag}@docker", f"b-{tag}@docker"
+
+    def row(name, ago, rate):
+        return TraefikMetric(router_name=name, scraped_at=now - timedelta(minutes=ago), request_rate=rate,
+                             error_rate_4xx_pct=0.0, error_rate_5xx_pct=0.0, latency_p50_ms=1.0,
+                             latency_p95_ms=2.0, latency_p99_ms=3.0, response_bytes_rate=0.0)
+
+    async def go():
+        async with app.db_sessionmaker() as s:
+            async with s.begin():
+                s.add_all([row(a, 3, 1.0), row(a, 1, 2.0), row(a, 2, 3.0), row(b, 5, 4.0)])
+            async with s.begin():
+                return {m.router_name: m for m in await latest_per_router(s)}
+
+    got = asyncio.run(go())
+    assert got[a].request_rate == 2.0 and got[a].scraped_at == now - timedelta(minutes=1)
+    assert got[b].request_rate == 4.0