feat: implement user profile management and oauth/traefik integration

User Profile (US-004):
- Add authenticated profile endpoints (GET/PUT /users/me)
- Add avatar upload with file validation (PNG/JPEG, max 2MB)
- Create frontend profile page with edit form and avatar upload
- Update app shell to link to profile page

OAuth/Traefik Integration:
- Externalize all Authentik URLs to environment variables
- Add domain configuration (API_DOMAIN, WEB_DOMAIN, AUTHENTIK_DOMAIN)
- Create docker-compose.traefik.yml for reverse proxy deployment
- Update OAuth redirect/callback URLs to use configured domains
- Add VITE_APP_URL for frontend public URL configuration

Quality gates: pytest (50 passed), ruff, mypy, npm test (12 passed), typecheck, lint, build

.env.example

@@ -17,8 +17,32 @@ DEBUG=true
 LOG_LEVEL=info
 REPO_BASE_PATH=/data/repos
 
+# Domain Configuration (for both development and traefik modes)
+API_DOMAIN=localhost
+WEB_DOMAIN=localhost
+AUTHENTIK_DOMAIN=authentik.local
+
+# Public URLs (optional - will be constructed from domains if not set)
+# API_PUBLIC_URL=https://api.example.com
+# WEB_PUBLIC_URL=https://app.example.com
+
+# Authentik Configuration
+AUTHENTIK_CLIENT_ID=headquarter-web
+AUTHENTIK_CLIENT_SECRET=change-me
+# Override Authentik URLs if they differ from the default pattern
+# AUTHENTIK_AUTHORIZE_URL=https://authentik.example.com/application/o/authorize/
+# AUTHENTIK_TOKEN_URL=https://authentik.example.com/application/o/token/
+# AUTHENTIK_JWKS_URL=https://authentik.example.com/application/o/headquarter-web/jwks/
+# AUTHENTIK_ISSUER=https://authentik.example.com/application/o/headquarter-web/
+AUTHENTIK_AUDIENCE=headquarter-web
+
 # Frontend Configuration
 VITE_API_URL=http://localhost:8000
+VITE_APP_URL=http://localhost:3000
 
 # Docker Configuration
 COMPOSE_PROJECT_NAME=headquarter
+
+# Traefik Configuration (for docker-compose.traefik.yml)
+# PROXY_WEB_NAME=headquarter-web
+# TRAEFIK_NETWORK=traefik