Feat: Agregar estructura PWA Nuxt4 y configuración de desarrollo

Configuración PWA:
- Agregar estructura completa de Nuxt4 para PWA
- Configurar .env.example con variables de entorno
- Preparar aplicación para instalación offline

Configuración Claude Code:
- Agregar .claude/ con settings y hooks
- Configurar entorno de desarrollo con Claude

CI/CD:
- Agregar .gitea/workflows para Gitea Actions
- Preparar pipeline de despliegue automático

Docker:
- Actualizar docker-compose.yml con servicios PWA
- Configurar networking entre servicios

Git:
- Actualizar .gitignore para excluir archivos de build
- Ignorar node_modules y archivos temporales

docker-compose.yml

@@ -1,32 +1,55 @@
 version: '3.8'
 
 services:
-  postgres:
-    image: postgres:16-alpine
-    container_name: riocata_postgres
-    environment:
-      POSTGRES_DB: riocata
-      POSTGRES_USER: riocata_user
-      POSTGRES_PASSWORD: riocata_password
-      PGDATA: /var/lib/postgresql/data/pgdata
-    ports:
-      - "5432:5432"
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-      - ./postgres/init:/docker-entrypoint-initdb.d
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U riocata_user -d riocata"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
+  app:
+    image: ${REG}/${REPO_OWNER}/${APP_NAME}:latest
+    container_name: ${APP_NAME}
     restart: unless-stopped
+    environment:
+      # Node Environment
+      - NODE_ENV=production
+      - NUXT_HOST=0.0.0.0
+      - NUXT_PORT=3000
+      # Public URL
+      - NUXT_PUBLIC_APP_URL=${NUXT_PUBLIC_APP_URL}
     networks:
-      - riocata_network
+      - principal
+      - traefik-network
+    labels:
+      # Traefik labels
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-network"
 
-volumes:
-  postgres_data:
-    driver: local
+      # Service (shared by both routers)
+      - "traefik.http.services.${APP_NAME}.loadbalancer.server.port=3000"
+
+      # Router 1: Public PWA resources (no auth) - Higher priority
+      - "traefik.http.routers.${APP_NAME}-public.rule=Host(`${APP_DOMAIN}`) && (PathPrefix(`/manifest.webmanifest`) || PathPrefix(`/sw.js`) || PathPrefix(`/workbox-`) || PathPrefix(`/icon-`) || PathPrefix(`/apple-touch-icon`) || PathPrefix(`/favicon.ico`) || PathPrefix(`/robots.txt`) || PathPrefix(`/offline.html`) || PathPrefix(`/api/_nuxt_icon/`))"
+      - "traefik.http.routers.${APP_NAME}-public.entrypoints=websecure"
+      - "traefik.http.routers.${APP_NAME}-public.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.${APP_NAME}-public.priority=100"
+      - "traefik.http.routers.${APP_NAME}-public.service=${APP_NAME}"
+      - "traefik.http.routers.${APP_NAME}-public.middlewares=${APP_NAME}-headers,${APP_NAME}-cors"
+
+      # Router 2: Protected application (with auth) - Normal priority
+      - "traefik.http.routers.${APP_NAME}.rule=Host(`${APP_DOMAIN}`)"
+      - "traefik.http.routers.${APP_NAME}.entrypoints=websecure"
+      - "traefik.http.routers.${APP_NAME}.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.${APP_NAME}.priority=10"
+      - "traefik.http.routers.${APP_NAME}.service=${APP_NAME}"
+      - "traefik.http.routers.${APP_NAME}.middlewares=authentik-forward-auth@file,${APP_NAME}-headers"
+
+      # Custom headers middleware
+      - "traefik.http.middlewares.${APP_NAME}-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
+
+      # CORS middleware for public resources
+      - "traefik.http.middlewares.${APP_NAME}-cors.headers.accesscontrolallowmethods=GET,OPTIONS"
+      - "traefik.http.middlewares.${APP_NAME}-cors.headers.accesscontrolalloworiginlist=https://${APP_DOMAIN}"
+      - "traefik.http.middlewares.${APP_NAME}-cors.headers.accesscontrolmaxage=100"
+      - "traefik.http.middlewares.${APP_NAME}-cors.headers.addvaryheader=true"
 
 networks:
-  riocata_network:
-    driver: bridge
+  principal:
+    external: true
+  traefik-network:
+    external: true