feat: implement user profile management and oauth/traefik integration

User Profile (US-004):
- Add authenticated profile endpoints (GET/PUT /users/me)
- Add avatar upload with file validation (PNG/JPEG, max 2MB)
- Create frontend profile page with edit form and avatar upload
- Update app shell to link to profile page

OAuth/Traefik Integration:
- Externalize all Authentik URLs to environment variables
- Add domain configuration (API_DOMAIN, WEB_DOMAIN, AUTHENTIK_DOMAIN)
- Create docker-compose.traefik.yml for reverse proxy deployment
- Update OAuth redirect/callback URLs to use configured domains
- Add VITE_APP_URL for frontend public URL configuration

Quality gates: pytest (50 passed), ruff, mypy, npm test (12 passed), typecheck, lint, build

openspec/changes/user-profile/specs/user-profile/spec.md

@@ -0,0 +1,50 @@
+# User Profile Management Specification
+
+## Purpose
+
+Manage user profiles including personal information and avatar.
+
+## Requirements
+
+### Requirement: Profile Retrieval
+
+The system SHALL allow users to view their profile.
+
+#### Scenario: View profile
+- GIVEN an authenticated user
+- WHEN they access the profile page
+- THEN their name, email, and avatar are displayed
+
+### Requirement: Profile Updates
+
+The system SHALL allow users to update their profile.
+
+#### Scenario: Update name and email
+- GIVEN an authenticated user
+- WHEN they submit profile changes
+- THEN the system validates the input
+- AND updates the user record
+
+### Requirement: Avatar Upload
+
+The system SHALL support local avatar storage.
+
+#### Scenario: Upload avatar
+- GIVEN an authenticated user
+- WHEN they upload an image file
+- THEN the system validates the file type and size
+- AND stores it locally
+- AND updates the user's avatar URL
+
+## Dependencies
+
+- auth-oauth (authenticated users)
+- Database models: User
+
+## Quality Gates
+
+- `pytest` must pass
+- `mypy .` must pass
+- `ruff check .` must pass
+- `npm run typecheck` must pass
+- `npm run lint` must pass