refactor: remove dead subdomain routing path

[mairas]

Summary

Pure dead-code removal. The multi-level mDNS subdomain approach is gone — halos-mdns-publisher is archived, no live system discovers subdomain hostnames, and the deployed reverse proxy in halos-core-containers routes by path under ${HALOS_DOMAIN} (expanded across configured hostnames by halos_expand_oidc_redirect_uri in lib-hostnames.sh).

No behavior change for any live deployment. The OIDC redirect URI list shape (http:// + https:// entries) is preserved; only the dead {subdomain}. prefix is dropped.

Changes

src/generate_container_packages/traefik.py — delete generate_traefik_labels (only called by its own tests; builder.py only calls inject_traefik_network, whose docstring already says "Traefik labels are NOT injected here — they're generated at runtime by the Traefik container based on routing.yml declarations"). Also delete _build_host_rule (only called by deleted function) and _extract_container_port (live copy lives in routing.py). Keep inject_traefik_network / inject_proxy_network / _detect_host_networking.

src/generate_container_packages/oidc_snippet.py — stop prepending {subdomain}. to the redirect URIs. Keep both http:// and https:// entries unchanged so the Authelia client allow-list shape is identical to before.

src/schemas/metadata.py — drop the subdomain field from TraefikConfig and RoutingConfig. Both default to extra="ignore", so any leftover subdomain: in a metadata.yaml is silently dropped instead of raising. Audited the workspace — zero live apps set the field.

Tests — tests/test_traefik_labels.py renamed to tests/test_traefik_network.py and collapsed to the proxy-network suite. TestExtractContainerPort coverage already lives in tests/test_routing.py::TestContainerPortExtraction (with a new test_container_port_integer_format pinning the isinstance(int) branch that was previously only covered in the deleted file). New test_legacy_subdomain_field_silently_ignored in test_routing_schema.py pins the backward-compat contract for RoutingConfig. Subdomain assertions / dead fixtures dropped elsewhere; regression-guard test renamed in test_routing.py.

Note on the "subtree cleanup" half of the issue

There is no container-packaging-tools/halos-core-containers/ subtree in this repo's git history (git log --all -- halos-core-containers/ is empty). What exists at that path in some checkouts is a separately cloned hatlabs/halos-core-containers working tree with its own .git and origin. Nothing in this repo to delete for that half of the scope — it's a personal working-tree artifact, not a c-p-t concern. Recommend closing that sub-scope as not-applicable.

Verification

• uv run pytest tests/ -m "not install and not docker and not slow" → 878 passed, 2 skipped, 16 deselected
• uv run ruff check src/ tests/ → All checks passed
• grep -rn "subdomain" src/ tests/ → only the intentional regression-guard test in tests/test_routing.py
• grep -rn "halos\.subdomain" workspace-wide → only the archived halos-mdns-publisher and the stale personal clone
• OIDC redirect_uris shape: still [http://${HALOS_DOMAIN}{path}, https://${HALOS_DOMAIN}{path}] — identical to before, minus the (always-dead) subdomain prefix

Net change

11 files changed, 128 insertions, 721 deletions (refactor) + bump to 0.6.1 + uv.lock sync. Three commits total.

Refs #204
Parent issue: halos-org/halos#111