feat: implement user profile management and oauth/traefik integration

User Profile (US-004):
- Add authenticated profile endpoints (GET/PUT /users/me)
- Add avatar upload with file validation (PNG/JPEG, max 2MB)
- Create frontend profile page with edit form and avatar upload
- Update app shell to link to profile page

OAuth/Traefik Integration:
- Externalize all Authentik URLs to environment variables
- Add domain configuration (API_DOMAIN, WEB_DOMAIN, AUTHENTIK_DOMAIN)
- Create docker-compose.traefik.yml for reverse proxy deployment
- Update OAuth redirect/callback URLs to use configured domains
- Add VITE_APP_URL for frontend public URL configuration

Quality gates: pytest (50 passed), ruff, mypy, npm test (12 passed), typecheck, lint, build

apps/api/tests/test_config.py

@@ -33,9 +33,9 @@ def test_auth_settings_have_secure_defaults() -> None:
 
     assert settings.authentik_client_id == "headquarter-web"
     assert settings.authentik_client_secret == "change-me"
-    assert settings.authentik_authorize_url.endswith("/application/o/authorize/")
-    assert settings.authentik_token_url.endswith("/application/o/token/")
-    assert settings.authentik_jwks_url.endswith("/application/o/headquarter-web/jwks/")
+    assert settings.resolved_authentik_authorize_url.endswith("/application/o/authorize/")
+    assert settings.resolved_authentik_token_url.endswith("/application/o/token/")
+    assert settings.resolved_authentik_jwks_url.endswith("/application/o/headquarter-web/jwks/")
     assert settings.jwt_algorithm == "HS256"
     assert settings.access_token_ttl_minutes == 15
     assert settings.refresh_token_ttl_days == 7