Certificates no longer depend on public port 80 reaching this host, and a
name can be certified before its A record points here (backyardhoneycomb.com
migration). Uses IAM user traefik-prod-dns01 from .env (AWS_REGION must be
set; the SDK needs it even for global Route 53), allowed only to write
_acme-challenge.* TXT records in the pkartchner.com and backyardhoneycomb.com
zones.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
