fix(traefik): Add TCP router with HostSNIRegexp for wildcard subdomain TLS

Add a TCP-level router using HostSNIRegexp to match unknown subdomains
at the TLS layer and terminate TLS with wildcard certificate.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

smoothschedule/compose/production/traefik/traefik.yml

@@ -53,6 +53,29 @@ tls:
           sans:
             - "*.smoothschedule.com"
 
+tcp:
+  routers:
+    # Catch-all for tenant subdomains at TLS layer
+    # This matches any subdomain that isn't handled by specific HTTP routers
+    subdomain-sni-router:
+      rule: 'HostSNIRegexp(`^[a-z0-9-]+\\.smoothschedule\\.com$`)'
+      entryPoints:
+        - web-secure
+      service: nginx-tcp
+      tls:
+        passthrough: false
+        certResolver: letsencrypt-dns
+        domains:
+          - main: "smoothschedule.com"
+            sans:
+              - "*.smoothschedule.com"
+
+  services:
+    nginx-tcp:
+      loadBalancer:
+        servers:
+          - address: "nginx:80"
+
 http:
   routers:
     # Main domain and www