COS: Create How-To guide for Traefik + MetalLB header resolution behind Cloud NAT

# Background

In our cloud environments, instance traffic is routed using 1:1 NAT (Public IP -> Internal IP). Inside our clusters, we use MetalLB as our load balancer, which binds to that Internal IP. Traefik sits behind MetalLB and acts as our ingress controller.

# The Problem

Because Traefik sits behind MetalLB, it automatically inherits MetalLB's internal IP (10.x.x.x) as its source of truth for the host network. If we do not explicitly override this, Traefik passes this internal IP down to our backend applications via X-Forwarded-Host and X-Forwarded-Server headers.

This causes a major issue: when backend applications generate absolute URLs, redirects, or OAuth callbacks, they build them using the unreachable internal IP instead of the public-facing domain or external IP that the user actually requested.

# Proposed Solution

We need to add a "How-To" guide to our documentation repository that explains this architecture quirk and provides the exact configuration needed to fix it.

Specifically, the documentation needs to show how to force Traefik charm to publish the external hostname/IP rather than picking up the MetalLB service IP.

This is done with [traefik external_hostname configuration](https://charmhub.io/traefik-k8s/configurations#external_hostname):
```
juju config traefik external_hostname=$EXTERNAL_IP
```