VPN protected login

The public page serves the login interface only. Submitted data is proxied into the internal API container and persisted in internal Postgres/MinIO containers that do not expose public ports.