Use the traefik-internal ingress class

Both IngressRoutes (server and Grafana) now use traefik-internal, like
the rest of *.k8s.stinnesbeck.com, instead of the traefik-external
placeholder. README and SPECS updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/ingress.yaml

@@ -1,14 +1,12 @@
-# Public routes. TLS uses Traefik's default certificate, so there is no per-host
-# Certificate here.
+# Routes on the traefik-internal class, like the rest of *.k8s.stinnesbeck.com. TLS uses
+# Traefik's default certificate, so there is no per-host Certificate here.
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: mg4-server
   namespace: mg4
   annotations:
-    # CHECK: the class of your public-facing Traefik. Your internal example uses
-    # "traefik-internal"; these hosts must be served by the external one.
-    kubernetes.io/ingress.class: traefik-external
+    kubernetes.io/ingress.class: traefik-internal
 spec:
   entryPoints:
     - websecure
@@ -28,7 +26,7 @@ metadata:
   name: grafana
   namespace: mg4
   annotations:
-    kubernetes.io/ingress.class: traefik-external # CHECK, as above
+    kubernetes.io/ingress.class: traefik-internal
 spec:
   entryPoints:
     - websecure