Traces first (CLAUDE.md); ipx-web traces its requests (#213)

Caddy's tracing directive, switched by WEB_TRACING so a server without a collector does not log
a failed export every few seconds. It continues an incoming traceparent (the page starts one per
tap, #190) and passes it to ipx, so a request is one trace from the browser through Caddy into
ipx, and Caddy's access log carries its traceID. Checked against Tempo with a probe container:
service.name and deployment.environment.name come from the OTEL_ variables, over OTLP/HTTP.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/Caddyfile

@@ -2,6 +2,10 @@
 # so the session cookie, live updates and Cloudflare Access work as they did when ipx served it.
 #   IPX_UPSTREAM  where ipx is, host:port            (ipx:8099)
 #   WEB_BIND      where to listen                    (:8080)
+#   WEB_TRACING   on: a span for each request to OpenTelemetry (OTEL_EXPORTER_OTLP_ENDPOINT,
+#                 OTEL_EXPORTER_OTLP_PROTOCOL, OTEL_SERVICE_NAME), continuing the page's traceparent
+#                 and passing it to ipx, so one trace runs browser, Caddy, ipx (#213). Off: none,
+#                 and no export failing every few seconds where there is nothing to send to.
 #   TUNNEL_PEER   the one address whose Cf-Access-* headers are passed on: where cloudflared's
 #                 requests come from. Nobody else's are, so nobody else can claim to be signed in
 #                 by Cloudflare. Unset passes none.
@@ -24,7 +28,17 @@
 	}
 }
 
+(tracing-on) {
+	tracing {
+		span ipx-web
+	}
+}
+(tracing-off) {
+}
+
 http://{$WEB_BIND::8080} {
+	import tracing-{$WEB_TRACING:off}
+
 	root * {$WEB_ROOT:/srv}
 
 	# One JSON line a request on stdout, for Loki and the dashboard's Page row (#210). Not the