fix(proxy): honor upstream X-Forwarded-Proto so OAuth redirect is https behind traefik

The SPA nginx overwrote the reverse proxy's X-Forwarded-Proto with $scheme (http on the
traefik->frontend hop), so the API built http:// OAuth redirects that Google rejects. Map
the incoming proto through (fallback to $scheme for direct access). Needed for login via
https://inboxintel.cesnimda.uk behind traefik.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/nginx.conf

@@ -1,3 +1,11 @@
+# Honor a reverse proxy's X-Forwarded-Proto (e.g. traefik terminating TLS) so the API sees
+# https and builds https OAuth redirects; fall back to the connection scheme for direct access.
+map $http_x_forwarded_proto $fwd_proto {
+    default $scheme;
+    https   https;
+    http    http;
+}
+
 server {
     listen 80;
     server_name _;
@@ -27,7 +35,7 @@ server {
         proxy_pass http://api:8080;
         proxy_set_header Host $http_host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $fwd_proto;
         proxy_set_header X-Forwarded-Host $http_host;
         proxy_set_header Cookie $http_cookie;
     }
@@ -38,7 +46,7 @@ server {
         proxy_pass http://api:8080;
         proxy_set_header Host $http_host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $fwd_proto;
         proxy_set_header X-Forwarded-Host $http_host;
         proxy_set_header Cookie $http_cookie;
     }