feat: implement user profile management and oauth/traefik integration

User Profile (US-004):
- Add authenticated profile endpoints (GET/PUT /users/me)
- Add avatar upload with file validation (PNG/JPEG, max 2MB)
- Create frontend profile page with edit form and avatar upload
- Update app shell to link to profile page

OAuth/Traefik Integration:
- Externalize all Authentik URLs to environment variables
- Add domain configuration (API_DOMAIN, WEB_DOMAIN, AUTHENTIK_DOMAIN)
- Create docker-compose.traefik.yml for reverse proxy deployment
- Update OAuth redirect/callback URLs to use configured domains
- Add VITE_APP_URL for frontend public URL configuration

Quality gates: pytest (50 passed), ruff, mypy, npm test (12 passed), typecheck, lint, build

apps/api/tests/test_auth_services.py

@@ -102,7 +102,7 @@ async def test_exchange_code_for_tokens_posts_expected_payload() -> None:
     settings = Settings()
 
     def handler(request: httpx.Request) -> httpx.Response:
-        assert request.url == httpx.URL(settings.authentik_token_url)
+        assert request.url == httpx.URL(settings.resolved_authentik_token_url)
         payload = dict(httpx.QueryParams(request.content.decode("utf-8")))
         assert payload["grant_type"] == "authorization_code"
         assert payload["code"] == "auth-code"