traefik: apply secure-headers before sso on the dashboard

forwardAuth answers unauthenticated requests itself, so a middleware listed
after it never sees that redirect: the dashboard's 302 to Keycloak went out
without HSTS, nosniff and frame options.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

traefik/compose.yaml

@@ -54,7 +54,9 @@ services:
       traefik.http.routers.dashboard.entrypoints: websecure
       traefik.http.routers.dashboard.tls.certresolver: le
       traefik.http.routers.dashboard.service: api@internal
-      traefik.http.routers.dashboard.middlewares: sso,secure-headers@file
+      # secure-headers first: sso answers unauthenticated requests itself, and
+      # middlewares after it never see that response.
+      traefik.http.routers.dashboard.middlewares: secure-headers@file,sso
       # Keycloak gate for the dashboard host only (cookie, return hosts and
       # role are tied to it; README "Adding a project"): unauthenticated
       # requests are sent to Keycloak, users without petrolyst:traefik-admin