- BFF on port 8200: auth + proxy to tracker - All /api/* routes go through BFF - WebSocket proxy with JWT auth - Tracker no longer exposed to internet - Logging on all requests - Removed Next.js API routes for auth (BFF handles it)