fix: add PKCE support for Logto auth and fix Traefik routing

Logto requires PKCE (Proof Key for Code Exchange) for SPA auth.
Added code_challenge/code_verifier to login and callback flow.

Also fixed Traefik router-service linking — when a container defines
multiple routers, each needs an explicit service binding or Traefik
v3 refuses to auto-link them.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -105,11 +105,14 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.api.rule=PathPrefix(`/api`)
+      - traefik.http.routers.api.service=api
       - traefik.http.services.api.loadbalancer.server.port=8080
       - traefik.http.routers.forwardauth.rule=Path(`/auth/verify`)
+      - traefik.http.routers.forwardauth.service=forwardauth
       - traefik.http.services.forwardauth.loadbalancer.server.port=8080
       - traefik.http.routers.spa.rule=PathPrefix(`/`)
       - traefik.http.routers.spa.priority=1
+      - traefik.http.routers.spa.service=spa
       - traefik.http.services.spa.loadbalancer.server.port=8080
     networks:
       - cameleer
@@ -133,11 +136,13 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.observe.rule=PathPrefix(`/observe`)
+      - traefik.http.routers.observe.service=observe
       - traefik.http.routers.observe.middlewares=forward-auth
       - traefik.http.middlewares.forward-auth.forwardauth.address=http://cameleer-saas:8080/auth/verify
       - traefik.http.middlewares.forward-auth.forwardauth.authResponseHeaders=X-Tenant-Id,X-User-Id,X-User-Email
       - traefik.http.services.observe.loadbalancer.server.port=8080
       - traefik.http.routers.dashboard.rule=PathPrefix(`/dashboard`)
+      - traefik.http.routers.dashboard.service=dashboard
       - traefik.http.routers.dashboard.middlewares=forward-auth,dashboard-strip
       - traefik.http.middlewares.dashboard-strip.stripprefix.prefixes=/dashboard
       - traefik.http.services.dashboard.loadbalancer.server.port=8080