fix(pangolin-labels): full blueprint labels minus region rules

Region value=EU is not a UN M.49 subregion id (the only real invalid reason)
so rules are omitted entirely, matching how existing resources are configured.

gitea/docker-compose.yml

@@ -32,15 +32,19 @@ services:
       - traefik.http.services.gitea.loadbalancer.server.port=3000
       - pangolin.public-resources.gitea.name=Gitea
       - pangolin.public-resources.gitea.full-domain=gitea.arnoutvw.nl
-      - pangolin.public-resources.gitea.mode=http
-      - pangolin.public-resources.gitea.name=Gitea
-      - pangolin.public-resources.gitea.full-domain=gitea.arnoutvw.nl
-      - pangolin.public-resources.gitea.mode=http
+      - pangolin.public-resources.gitea.protocol=http
+      - pangolin.public-resources.gitea.ssl=true
       - pangolin.public-resources.gitea.targets[0].method=http
-      # target hostname+port are auto-detected by pangolin from the container
-      # (docker DNS + exposed port); ssl defaults to on. String label values
-      # (port numbers / booleans) fail pangolin's Zod blueprint validation,
-      # so only string-typed fields are set via labels.
+      - pangolin.public-resources.gitea.targets[0].hostname=192.168.10.144
+      - pangolin.public-resources.gitea.targets[0].port=3322
+      - pangolin.public-resources.gitea.targets[0].healthcheck.hostname=192.168.10.144
+      - pangolin.public-resources.gitea.targets[0].healthcheck.port=3322
+      - pangolin.public-resources.gitea.targets[0].healthcheck.enabled=true
+      - pangolin.public-resources.gitea.auth.sso-enabled=false
+
+      # port/ssl/healthcheck-string values are coerced by pangolin; only the
+      # region-rule (value=EU, not a valid UN M.49 subregion) was rejected —
+      # existing resources carry no rules, so none are set via labels.
 
   gitea-runner:
     image: gitea/act_runner:0.6.1

komodo/docker-compose.yml

@@ -62,9 +62,15 @@ services:
       - traefik.http.services.komodo.loadbalancer.server.port=9120
       - pangolin.public-resources.komodo.name=Komodo
       - pangolin.public-resources.komodo.full-domain=komodo.arnoutvw.nl
-      - pangolin.public-resources.komodo.mode=http
+      - pangolin.public-resources.komodo.protocol=http
+      - pangolin.public-resources.komodo.ssl=true
       - pangolin.public-resources.komodo.targets[0].method=http
-      # target hostname+port auto-detected (container name + exposed port);
+      - pangolin.public-resources.komodo.targets[0].hostname=192.168.10.144
+      - pangolin.public-resources.komodo.targets[0].port=9120
+      - pangolin.public-resources.komodo.targets[0].healthcheck.hostname=192.168.10.144
+      - pangolin.public-resources.komodo.targets[0].healthcheck.port=9120
+      - pangolin.public-resources.komodo.targets[0].healthcheck.enabled=true
+      - pangolin.public-resources.komodo.auth.sso-enabled=false
       # ssl defaults on. See gitea note: string-typed labels only.
 
   komodo-mcp: