The SPA nginx overwrote the reverse proxy's X-Forwarded-Proto with $scheme (http on the
traefik->frontend hop), so the API built http:// OAuth redirects that Google rejects. Map
the incoming proto through (fallback to $scheme for direct access). Needed for login via
https://inboxintel.cesnimda.uk behind traefik.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>