feat(#37-41): Add domains, ideas, relationships, agents, widgets schema

Schema additions for issues #37-41:

New models:
- Domain (#37): Life domains (work, marriage, homelab, etc.)
- Idea (#38): Brain dumps with pgvector embeddings
- Relationship (#39): Generic entity linking (blocks, depends_on)
- Agent (#40): ClawdBot agent tracking with metrics
- AgentSession (#40): Conversation session tracking
- WidgetDefinition (#41): HUD widget registry
- UserLayout (#41): Per-user dashboard configuration

Updated models:
- Task, Event, Project: Added domainId foreign key
- User, Workspace: Added new relations

New enums:
- IdeaStatus: CAPTURED, PROCESSING, ACTIONABLE, ARCHIVED, DISCARDED
- RelationshipType: BLOCKS, BLOCKED_BY, DEPENDS_ON, etc.
- AgentStatus: IDLE, WORKING, WAITING, ERROR, TERMINATED
- EntityType: Added IDEA, DOMAIN

Migration: 20260129182803_add_domains_ideas_agents_widgets

docker/traefik/dynamic/tls.yml

@@ -0,0 +1,16 @@
+# Traefik Dynamic TLS Configuration
+# This file configures TLS options and certificates
+
+# TLS Options
+tls:
+  options:
+    default:
+      minVersion: VersionTLS12
+      cipherSuites:
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+      sniStrict: false
+
+# Self-signed certificate stores (for development)
+# In production, use Let's Encrypt via certificatesResolvers in traefik.yml

docker/traefik/traefik.yml

@@ -0,0 +1,57 @@
+# Traefik Static Configuration
+# This file defines Traefik's core behavior and entry points
+
+# API and Dashboard
+api:
+  dashboard: true
+  insecure: true  # Dashboard accessible on port 8080 (for dev/testing)
+
+# Entry Points (HTTP and HTTPS)
+entryPoints:
+  web:
+    address: ":80"
+    # Redirect HTTP to HTTPS (uncomment in production)
+    # http:
+    #   redirections:
+    #     entryPoint:
+    #       to: websecure
+    #       scheme: https
+
+  websecure:
+    address: ":443"
+    # TLS configuration
+    http:
+      tls:
+        options: default
+
+# Providers
+providers:
+  # Docker provider for automatic service discovery
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false  # Only services with traefik.enable=true
+    network: mosaic-public    # Default network for Traefik
+
+  # File provider for additional configurations
+  file:
+    directory: "/etc/traefik/dynamic"
+    watch: true
+
+# Logging
+log:
+  level: INFO  # DEBUG, INFO, WARN, ERROR
+  format: common
+
+# Access Logs
+accessLog:
+  format: common
+  bufferingSize: 100
+
+# Let's Encrypt / ACME (uncomment for production)
+# certificatesResolvers:
+#   letsencrypt:
+#     acme:
+#       email: "${TRAEFIK_ACME_EMAIL}"
+#       storage: "/letsencrypt/acme.json"
+#       httpChallenge:
+#         entryPoint: web