- Task key from backend (TE-1 format)
- BFF config: all from env vars, no defaults for secrets
- CORS: dev.team.uix.su added
- STORAGE_ROOT for file storage
- Build with NEXT_PUBLIC_API_URL=https://dev.team.uix.su
- BFF on port 8200: auth + proxy to tracker
- All /api/* routes go through BFF
- WebSocket proxy with JWT auth
- Tracker no longer exposed to internet
- Logging on all requests
- Removed Next.js API routes for auth (BFF handles it)