feat(#37-41): Add domains, ideas, relationships, agents, widgets schema

Schema additions for issues #37-41:

New models:
- Domain (#37): Life domains (work, marriage, homelab, etc.)
- Idea (#38): Brain dumps with pgvector embeddings
- Relationship (#39): Generic entity linking (blocks, depends_on)
- Agent (#40): ClawdBot agent tracking with metrics
- AgentSession (#40): Conversation session tracking
- WidgetDefinition (#41): HUD widget registry
- UserLayout (#41): Per-user dashboard configuration

Updated models:
- Task, Event, Project: Added domainId foreign key
- User, Workspace: Added new relations

New enums:
- IdeaStatus: CAPTURED, PROCESSING, ACTIONABLE, ARCHIVED, DISCARDED
- RelationshipType: BLOCKS, BLOCKED_BY, DEPENDS_ON, etc.
- AgentStatus: IDLE, WORKING, WAITING, ERROR, TERMINATED
- EntityType: Added IDEA, DOMAIN

Migration: 20260129182803_add_domains_ideas_agents_widgets

.env.traefik-bundled.example

@@ -0,0 +1,85 @@
+# Traefik Bundled Mode Configuration
+# Copy this to .env to enable bundled Traefik reverse proxy
+#
+# Usage:
+#   cp .env.traefik-bundled.example .env
+#   docker compose --profile traefik-bundled up -d
+
+# ======================
+# Traefik Configuration
+# ======================
+TRAEFIK_MODE=bundled
+TRAEFIK_ENABLE=true
+TRAEFIK_ENTRYPOINT=websecure
+TRAEFIK_DOCKER_NETWORK=mosaic-public
+
+# Domain configuration
+MOSAIC_API_DOMAIN=api.mosaic.local
+MOSAIC_WEB_DOMAIN=mosaic.local
+MOSAIC_AUTH_DOMAIN=auth.mosaic.local
+
+# TLS/SSL Configuration
+TRAEFIK_TLS_ENABLED=true
+# For Let's Encrypt (production):
+# TRAEFIK_ACME_EMAIL=admin@example.com
+# TRAEFIK_CERTRESOLVER=letsencrypt
+# For self-signed certificates (development), leave TRAEFIK_ACME_EMAIL empty
+TRAEFIK_ACME_EMAIL=
+
+# Traefik Dashboard
+TRAEFIK_DASHBOARD_ENABLED=true
+TRAEFIK_DASHBOARD_PORT=8080
+
+# Traefik Ports
+TRAEFIK_HTTP_PORT=80
+TRAEFIK_HTTPS_PORT=443
+
+# ======================
+# Application Ports (not exposed when using Traefik)
+# ======================
+API_PORT=3001
+WEB_PORT=3000
+
+# ======================
+# PostgreSQL Database
+# ======================
+POSTGRES_USER=mosaic
+POSTGRES_PASSWORD=REPLACE_WITH_SECURE_PASSWORD
+POSTGRES_DB=mosaic
+POSTGRES_PORT=5432
+
+# ======================
+# Valkey Cache
+# ======================
+VALKEY_PORT=6379
+VALKEY_MAXMEMORY=256mb
+
+# ======================
+# Authentication (Authentik OIDC)
+# ======================
+OIDC_ISSUER=https://auth.mosaic.local/application/o/mosaic-stack/
+OIDC_CLIENT_ID=your-client-id-here
+OIDC_CLIENT_SECRET=your-client-secret-here
+OIDC_REDIRECT_URI=https://api.mosaic.local/auth/callback
+
+# Authentik Configuration
+AUTHENTIK_SECRET_KEY=REPLACE_WITH_RANDOM_SECRET_MINIMUM_50_CHARS
+AUTHENTIK_BOOTSTRAP_PASSWORD=REPLACE_WITH_SECURE_PASSWORD
+AUTHENTIK_BOOTSTRAP_EMAIL=admin@localhost
+AUTHENTIK_COOKIE_DOMAIN=.mosaic.local
+
+AUTHENTIK_POSTGRES_USER=authentik
+AUTHENTIK_POSTGRES_PASSWORD=REPLACE_WITH_SECURE_PASSWORD
+AUTHENTIK_POSTGRES_DB=authentik
+
+# ======================
+# JWT Configuration
+# ======================
+JWT_SECRET=REPLACE_WITH_RANDOM_SECRET_MINIMUM_32_CHARS
+JWT_EXPIRATION=24h
+
+# ======================
+# Docker Compose Profiles
+# ======================
+# Enable bundled Traefik and optional services
+COMPOSE_PROFILES=traefik-bundled,authentik