Convex-only Slice 1: clients talk to Convex, Flue is a private worker (#20)

deploy/zopu-runtime/caddy/Caddyfile

@@ -1,13 +1,21 @@
 # Caddyfile — Public reverse proxy for the Zopu web + API.
 #
-# The web frontend (port 5173) is served at the root, and the Flue agent/API
-# (port 3585) is mounted under /api so the browser talks same-origin.
+# The web frontend (port 5173) is served at the root, Better Auth is proxied
+# first-party under /api/auth, and Flue is mounted under /api/flue.
 
 zopu.cheaptricks.puter.wtf {
 	bind 135.181.82.179 2a01:4f9:c013:4a64::1
 	encode zstd gzip
 
-	handle_path /api/* {
+	handle /api/auth/* {
+		reverse_proxy https://befitting-dalmatian-161.convex.site {
+			header_up Host befitting-dalmatian-161.convex.site
+			header_up X-Forwarded-Host {host}
+			header_up X-Forwarded-Proto {scheme}
+		}
+	}
+
+	handle_path /api/flue/* {
 		reverse_proxy 127.0.0.1:3585
 	}