Enable auth-service/api-gateway on production, build their images in CI

apps/api-gateway/src/app.module.ts

@@ -0,0 +1,7 @@
+import { Module } from "@nestjs/common";
+import { ProxyModule } from "./proxy/proxy.module";
+
+@Module({
+  imports: [ProxyModule],
+})
+export class AppModule {}

apps/api-gateway/src/config.ts

@@ -0,0 +1,11 @@
+export interface Settings {
+  port: number;
+  authServiceUrl: string;
+}
+
+export function loadSettings(): Settings {
+  return {
+    port: Number(process.env.PORT ?? 3000),
+    authServiceUrl: process.env.AUTH_SERVICE_URL ?? "http://localhost:3010",
+  };
+}

apps/api-gateway/src/main.ts

@@ -0,0 +1,12 @@
+import "reflect-metadata";
+import { NestFactory } from "@nestjs/core";
+import { AppModule } from "./app.module";
+import { loadSettings } from "./config";
+
+async function bootstrap() {
+  const settings = loadSettings();
+  const app = await NestFactory.create(AppModule);
+  await app.listen(settings.port, "0.0.0.0");
+}
+
+bootstrap();

apps/api-gateway/src/proxy/auth-proxy.controller.ts

@@ -0,0 +1,38 @@
+import { All, Controller, Req, Res } from "@nestjs/common";
+import type { Request, Response } from "express";
+import { loadSettings } from "../config";
+
+const settings = loadSettings();
+
+/**
+ * Thin proxy: forwards `/auth/*` to auth-service verbatim (method, body,
+ * `Authorization` header) and relays the response back unchanged. This is
+ * intentionally the ENTIRE gateway surface for this pass — chat/history/
+ * feedback/sections keep going straight from `apps/web`'s BFF to
+ * `ai-service`, not through here (see the plan this was built from). Growing
+ * this into the README's full "single public entry point" is future work,
+ * not done by accident just because this file exists.
+ */
+@Controller("auth")
+export class AuthProxyController {
+  @All("*")
+  async proxy(@Req() req: Request, @Res() res: Response): Promise<void> {
+    const target = `${settings.authServiceUrl}${req.originalUrl}`;
+    const hasBody = req.method !== "GET" && req.method !== "HEAD";
+    const upstream = await fetch(target, {
+      method: req.method,
+      headers: {
+        "Content-Type": "application/json",
+        ...(req.headers.authorization
+          ? { Authorization: req.headers.authorization }
+          : {}),
+      },
+      body: hasBody ? JSON.stringify(req.body ?? {}) : undefined,
+    });
+    const payload = await upstream.text();
+    res
+      .status(upstream.status)
+      .setHeader("Content-Type", upstream.headers.get("content-type") ?? "application/json")
+      .send(payload);
+  }
+}

apps/api-gateway/src/proxy/proxy.module.ts

@@ -0,0 +1,7 @@
+import { Module } from "@nestjs/common";
+import { AuthProxyController } from "./auth-proxy.controller";
+
+@Module({
+  controllers: [AuthProxyController],
+})
+export class ProxyModule {}