fix(gatekeeper): standardize auth headers and path-based routing

.gitea/workflows/deploy.yml

@@ -228,13 +228,31 @@ jobs:
         env:
           TRAEFIK_RULE:     ${{ needs.prepare.outputs.traefik_rule }}
         run: |
+          # Middleware & Auth Logic
+          LOG_LEVEL=$( [[ "$TARGET" == "testing" || "$TARGET" == "development" ]] && echo "debug" || echo "info" )
+          STD_MW="${PROJECT_NAME}-forward,compress"
+          
+          if [[ "$TARGET" == "production" ]]; then
+            AUTH_MIDDLEWARE="$STD_MW"
+            COMPOSE_PROFILES=""
+          else
+            # Order: Forward (Proto) -> Auth -> Compression
+            AUTH_MIDDLEWARE="${PROJECT_NAME}-forward,${PROJECT_NAME}-auth,compress"
+            COMPOSE_PROFILES="gatekeeper"
+          fi
+          
+          # Gatekeeper Origin
+          GATEKEEPER_ORIGIN="$NEXT_PUBLIC_BASE_URL/gatekeeper"
+
           # Generate Environment File
           cat > .env.deploy << EOF
           # Generated by CI - $TARGET
           IMAGE_TAG=$IMAGE_TAG
           NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
+          GATEKEEPER_ORIGIN=$GATEKEEPER_ORIGIN
           SENTRY_DSN=$SENTRY_DSN
           PROJECT_COLOR=$PROJECT_COLOR
+          LOG_LEVEL=$LOG_LEVEL
           
           # Directus
           DIRECTUS_URL=$DIRECTUS_URL
@@ -270,12 +288,13 @@ jobs:
           TARGET=$TARGET
           SENTRY_ENVIRONMENT=$TARGET
           PROJECT_NAME=$PROJECT_NAME
-          TRAEFIK_HOST_RULE='$TRAEFIK_RULE'
+          ENV_FILE=$ENV_FILE
+          TRAEFIK_RULE='$TRAEFIK_RULE'
+          TRAEFIK_HOST='$TRAEFIK_HOST'
+          COMPOSE_PROFILES=$COMPOSE_PROFILES
+          TRAEFIK_MIDDLEWARES=$AUTH_MIDDLEWARE
           EOF
 
-          # TRAEFIK_MIDDLEWARES logic
-          printf "TRAEFIK_MIDDLEWARES=%s\n" "$( [[ "$TARGET" == "production" ]] && echo "${PROJECT_NAME}-forward,compress" || echo "${PROJECT_NAME}-auth,${PROJECT_NAME}-forward,compress" )" >> .env.deploy
-
       - name: 🚀 SSH Deploy
         shell: bash
         env: