docs: sync oauth-traefik-integration specs to main specs

- Update auth-oauth spec: configurable endpoints via environment variables
- Update docker-infrastructure spec: add traefik deployment mode
- Add traefik-deployment spec: new capability for reverse proxy deployment

openspec/specs/auth-oauth/spec.md

@@ -5,19 +5,20 @@
 Manage user authentication via Authentik OAuth with secure session handling.
 ## Requirements
 ### Requirement: OAuth2/OIDC Flow
-The system SHALL support OAuth2/OIDC authentication via Authentik and SHALL validate Authentik-issued tokens via JWKS before creating local sessions.
+The system SHALL support OAuth2/OIDC authentication via Authentik with fully configurable endpoints and SHALL validate Authentik-issued tokens via JWKS before creating local sessions.
 
 #### Scenario: User login
 - GIVEN a user clicks the login button
 - WHEN the frontend redirects to Authentik authorization endpoint
-- THEN the user authenticates with Authentik
+- THEN the redirect URI SHALL be constructed from environment-configured domains
-- AND Authentik redirects back with authorization code
+- AND the Authentik authorize URL SHALL be read from environment variables
 
 #### Scenario: Token exchange and validation
 - GIVEN Authentik has redirected with authorization code
 - WHEN the callback endpoint receives the code
-- THEN it exchanges the code for provider tokens
+- THEN it exchanges the code for provider tokens at the configured token URL
-- AND verifies token signature and claims using Authentik JWKS
+- AND verifies token signature using the configured JWKS URL
+- AND validates the issuer and audience from environment configuration
 - AND upserts the local user account
 - AND mints internal access and refresh tokens
 

openspec/specs/docker-infrastructure/spec.md

@@ -8,17 +8,16 @@ Provide a complete Docker-based development environment with all required servic
 
 ### Requirement: Docker Compose Setup
 
-The system SHALL provide a `docker-compose.yml` with all platform services.
+The system SHALL provide Docker Compose configurations for both development and traefik deployment.
 
-#### Scenario: Service definitions
+#### Scenario: Development compose file
 - GIVEN the development environment
-- THEN `docker-compose.yml` SHALL define:
+- THEN `docker-compose.yml` SHALL define all platform services for local development
-  - PostgreSQL database with health checks
+
-  - Redis cache with health checks
+#### Scenario: Traefik compose file
-  - Traefik reverse proxy with dashboard
+- GIVEN the production deployment
-  - Authentik authentication server
+- THEN `docker-compose.traefik.yml` SHALL define all platform services behind Traefik
-  - API service (FastAPI)
+- AND no ports SHALL be exposed directly (all traffic through Traefik)
-  - Web frontend (React/Vite)
 
 ### Requirement: Multi-Stage API Dockerfile
 
@@ -50,17 +49,19 @@ The system SHALL build the web frontend for production deployment.
 
 ### Requirement: Environment Configuration
 
-The system SHALL document all required environment variables.
+The system SHALL document all required environment variables for both development and traefik deployment modes.
 
 #### Scenario: Environment setup
-- GIVEN a new developer
+- GIVEN a new developer or operator
 - WHEN they set up the project
-- THEN `.env.example` SHALL document:
+- THEN `.env.example` SHALL document all variables for both modes
+- AND variables SHALL include:
   - Database connection strings
   - Redis connection strings
   - Authentik configuration
   - JWT secrets
   - Docker volume paths
+  - Domain configuration for traefik mode
   - External service URLs
 
 ### Requirement: Service Health Checks

openspec/specs/traefik-deployment/spec.md

@@ -0,0 +1,31 @@
+## ADDED Requirements
+
+### Requirement: Traefik Docker Compose
+
+The system SHALL provide a `docker-compose.traefik.yml` for deployment behind an existing Traefik reverse proxy.
+
+#### Scenario: Service labels
+- GIVEN the traefik deployment configuration
+- WHEN services are started
+- THEN `docker-compose.traefik.yml` SHALL define Traefik Docker labels for each service
+- AND all routing rules SHALL use configurable domain names
+
+#### Scenario: Environment variables
+- GIVEN the traefik deployment configuration
+- WHEN configuring the deployment
+- THEN all domain names SHALL be configurable via environment variables
+- AND the proxy web name SHALL be configurable via environment variable
+
+### Requirement: Environment Configuration
+
+The system SHALL document all required environment variables for traefik deployment.
+
+#### Scenario: Required variables
+- GIVEN a new deployment
+- WHEN setting up environment variables
+- THEN `.env.example` SHALL document:
+  - `API_DOMAIN` - domain for API service
+  - `WEB_DOMAIN` - domain for web frontend
+  - `AUTHENTIK_DOMAIN` - domain for Authentik instance
+  - `PROXY_WEB_NAME` - name for web proxy service
+  - All Authentik OIDC configuration variables