## 1. Externalize Authentik and domain configuration

- [x] 1.1 Update `apps/api/src/config.py` to read all Authentik URLs from environment variables with no hardcoded defaults.
- [x] 1.2 Add `API_PUBLIC_URL`, `WEB_PUBLIC_URL`, and related domain env vars to config.py.
- [x] 1.3 Update `apps/api/src/api/auth.py` to construct OAuth redirect/callback URLs from configured domains.
- [x] 1.4 Update `.env.example` with all new environment variables for Authentik and domain configuration.

## 2. Create Traefik deployment compose file

- [x] 2.1 Create `docker-compose.traefik.yml` with all services configured for Traefik reverse proxy.
- [x] 2.2 Add Traefik Docker labels to all services with configurable domain-based routing rules.
- [x] 2.3 Ensure no ports are exposed directly in traefik mode (all through Traefik).
- [x] 2.4 Add `PROXY_WEB_NAME` and other traefik-specific env vars to `.env.example`.

## 3. Frontend configuration

- [x] 3.1 Update frontend to support configurable public URL for OAuth redirect.
- [x] 3.2 Update `apps/web/.env.example` or relevant config with `VITE_APP_URL`.

## 4. Verification and testing

- [x] 4.1 Run backend quality gates (`pytest`, `ruff`, `mypy`).
- [x] 4.2 Run frontend quality gates (`npm test`, `typecheck`, `lint`, `build`).
- [x] 4.3 Validate `docker-compose config` works for both compose files.
- [x] 4.4 Update this tasks file with completed checkboxes.