chore(traefik): clearer naming for aggregated services

roles/traefik/defaults/main.yml

@@ -51,20 +51,28 @@ log_level: "INFO"
 # Network name
 traefik_network: "proxy"
 
-# Services to expose (defined by application roles via host_vars or group_vars)
-# Each backend server should define this variable with their services
-# traefik_services:
+# Services to expose through DMZ (defined on backend servers via host_vars)
+# The DMZ proxy aggregates these from all backend_servers and auto-populates backend_host
+# traefik_dmz_exposed_services:
 #   - name: httpbin
 #     domain: httpbin.example.com
 #     port: 8080
 #     protocol: http  # http or https
-#     entrypoints: [websecure]  # optional, defaults based on SSL config
+
+# Services to expose directly on the proxy (for hosts not managed by Ansible)
+# Define on the DMZ host itself - requires explicit backend_host
+# traefik_services:
+#   - name: external-api
+#     domain: api.example.com
+#     backend_host: 10.0.0.50  # required for direct definitions
+#     port: 8080
+#     protocol: http
 
 # DMZ mode: Explicit backend server mapping
 # Define which backend servers this DMZ proxy should route to
 # If empty or undefined, routes to all servers in backend_servers group
-backend_servers_to_proxy: []
+traefik_backend_servers_to_proxy: []
 # Example:
-# backend_servers_to_proxy:
+# traefik_backend_servers_to_proxy:
 #   - backend1
 #   - backend2