traefik standalone adoption kit: live config versioned + compose + komodo panel router

- traefik.yml/dynamic/* copied from /etc/dokploy/traefik (acme.json gitignored — stays on host)
- compose.yaml: same image/binds/ports as dokploy-traefik, joins dokploy-network + komodo
- dynamic/komodo.yml: komodo.paginica.com router (inactive until cutover)

dynamic/authentik-forwardauth.yml

@@ -0,0 +1,93 @@
+# Traefik dynamic config — forward auth via authentik embedded outpost.
+# Deploy to: /etc/dokploy/traefik/dynamic/authentik-forwardauth.yml
+# All objects carry the `ak-` prefix; this file is never managed by Dokploy.
+#
+# Bypass model: the gated Host router (managed by Dokploy domain middlewares)
+# covers UI paths only. More-specific rules win automatically:
+#   Host + PathPrefix(`/outpost.goauthentik.io`) -> outpost   (auth callbacks)
+#   Host + PathPrefix(`/api`)                   -> app API   (CLI/SDK/agents/UI fetches)
+http:
+  services:
+    ak-authentik:
+      loadBalancer:
+        servers:
+          - url: http://authentik-server:9000
+        passHostHeader: true
+    ak-dokploy:
+      loadBalancer:
+        servers:
+          - url: http://dokploy:3000
+        passHostHeader: true
+    ak-infisical:
+      loadBalancer:
+        servers:
+          - url: http://infisical:8080
+        passHostHeader: true
+
+  middlewares:
+    ak-fw:
+      forwardAuth:
+        # embedded outpost reachable internally — no Cloudflare roundtrip
+        address: http://authentik-server:9000/outpost.goauthentik.io/auth/traefik
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-authentik-username
+          - X-authentik-groups
+          - X-authentik-email
+          - X-authentik-name
+          - X-authentik-uid
+          - X-authentik-jwt
+          - X-authentik-meta-jwks
+          - X-authentik-meta-outpost
+          - X-authentik-meta-provider
+          - X-authentik-meta-app
+          - X-authentik-meta-version
+    ak-fw-errors:
+      # turns the outpost 401 into its login redirect for browsers;
+      # machine paths bypass via dedicated routers and never see this
+      errors:
+        status: ["401-403"]
+        service: ak-authentik
+        query: /outpost.goauthentik.io/start?rd={url}
+
+  routers:
+    # Outpost endpoints on each gated host (forward_single mode needs these
+    # public: start/callback/sign_out live on the application domain).
+    ak-infisical-outpost:
+      rule: Host(`infisical.paginica.com`) && PathPrefix(`/outpost.goauthentik.io`)
+      service: ak-authentik
+      entryPoints: [websecure]
+      tls:
+        certResolver: letsencrypt
+      priority: 1000
+    ak-panel-outpost:
+      rule: Host(`panel.paginica.com`) && PathPrefix(`/outpost.goauthentik.io`)
+      service: ak-authentik
+      entryPoints: [websecure]
+      tls:
+        certResolver: letsencrypt
+      priority: 1000
+
+
+
+    # Infisical API bypass — UI fetches, CLI, SDK, agentes y syncs usan /api
+    # con tokens propios de Infisical; gated /api romperia el propio web vault.
+    ak-infisical-api:
+      rule: Host(`infisical.paginica.com`) && PathPrefix(`/api`)
+      service: ak-infisical
+      entryPoints: [websecure]
+      tls:
+        certResolver: letsencrypt
+      priority: 900
+
+    # Panel API bypass — keeps /api (tRPC, better-auth, deploy webhooks)
+    # outside the auth gate. Higher priority than the gated root router.
+    ak-panel-api:
+      rule: Host(`panel.paginica.com`) && PathPrefix(`/api`)
+      service: ak-dokploy
+      entryPoints: [websecure]
+      tls:
+        certResolver: letsencrypt
+      priority: 900
+
+