fix: add PKCE support for Logto auth and fix Traefik routing

Logto requires PKCE (Proof Key for Code Exchange) for SPA auth.
Added code_challenge/code_verifier to login and callback flow.

Also fixed Traefik router-service linking — when a container defines
multiple routers, each needs an explicit service binding or Traefik
v3 refuses to auto-link them.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/CallbackPage.tsx

@@ -3,6 +3,7 @@ import { useNavigate } from 'react-router';
 import { useAuthStore } from './auth-store';
 import { Spinner } from '@cameleer/design-system';
 import { fetchConfig } from '../config';
+import { getCodeVerifier } from './pkce';
 
 export function CallbackPage() {
   const navigate = useNavigate();
@@ -16,6 +17,12 @@ export function CallbackPage() {
       return;
     }
 
+    const codeVerifier = getCodeVerifier();
+    if (!codeVerifier) {
+      navigate('/login');
+      return;
+    }
+
     const redirectUri = `${window.location.origin}/callback`;
 
     fetchConfig().then((config) => {
@@ -27,6 +34,7 @@ export function CallbackPage() {
           code,
           client_id: config.logtoClientId,
           redirect_uri: redirectUri,
+          code_verifier: codeVerifier,
         }),
       })
         .then((r) => r.json())