What does the TLS shield icon mean?

The resolver need to be "linked" to router, if you don't do that the resolver do nothing at all.

If you don't trust me, you can validate the behavior like that: stop your Traefik, remove (and backup) the acme.json file, set the caserver to use the LE stagging (to avoid rate limiting during the test) and start Traefik.