Traefik matches Gateway listener ports against entryPoint internal ports.
websecure was on 8443 so port 443 listeners were rejected as PortUnavailable.
Change websecure to listen on 443 and add NET_BIND_SERVICE capability to
allow binding to privileged ports as a non-root user.