You're correct - the sticky flag was pointless. I was using tcp because of this thread, where someone wrote the following:
I can confirm that Windows Integrated authentication works successfully with Traefik 2.0 using TCP routers with successful logins proven on Windows/Mac using Safari/Chrome/IE.
... but perhaps it was a Traefik v2 thing.
However, I'm still left with the weird two-time logon issue, and that's going to be an issue with... well, everything (in this proxy case at least) - since MS DevOps is also used for GIT as well as Nuget operations - if the first request always ends up failing this is bound to cause a lot of problems.