feat: add traefik tcp load balancer

docs/testing.md

@@ -1,23 +1,27 @@
 # Testing
 
-Describe how tests are executed.
-
-All tests should run inside Docker containers.
+All project validation should run through Docker-based commands.
 
 ## Canonical test command
 
+The canonical project validation command is:
+
 ```bash
-CHANGE_ME
+docker compose config
 ```
 
+## Smoke test
+
+After replacing the example backend addresses and starting the stack, verify TCP connectivity from a client:
+
+```bash
+openssl s_client -connect LOAD_BALANCER_HOST:443 -servername EXPECTED_DNS_NAME
+```
+
+The certificate shown by `openssl` should be the backend certificate, not a certificate stored by Traefik.
+
 ## Test categories
 
-Describe applicable categories:
-
-- unit tests;
-- integration tests;
-- linting;
-- formatting checks;
-- Ansible syntax checks;
-- Docker/Compose validation;
-- smoke tests.
+- Docker/Compose validation: `docker compose config`.
+- Runtime health: `docker compose ps`.
+- TLS passthrough smoke test: `openssl s_client`.