- BFF on port 8200: auth + proxy to tracker
- All /api/* routes go through BFF
- WebSocket proxy with JWT auth
- Tracker no longer exposed to internet
- Logging on all requests
- Removed Next.js API routes for auth (BFF handles it)
- Remove middleware (no SSR auth check)
- AuthGuard component checks localStorage token
- Protected route group (protected) wraps all pages
- Login page is public
- All API calls use Authorization: Bearer header
- Login page with form
- Middleware redirects unauthenticated to /login
- Cookie session (7 days)
- Credentials via AUTH_USER/AUTH_PASS env vars
- Default: admin/teamboard
- Kanban with drag-and-drop (5 columns)
- Project sidebar navigation
- API client (projects, tasks, agents, labels)
- Tailwind CSS dark theme
- Docker support, SSR with internal API URL
- Port 3100 (3000 occupied by Gitea)