fix: proxy OAuth2/login/logout paths through nginx to Spring BFF

nginx was only forwarding /api/* to the backend.
Added proxy locations for:
  - /oauth2/  (Spring Security login initiation)
  - /login/oauth2/  (OAuth2 authorization code callback)
  - /logout  (Spring Security logout + RP-initiated end-session)

Also revert incorrect /api prefix on the login redirect URL.

frontend/src/app/app.ts

@@ -42,7 +42,7 @@ export class App implements OnInit {
   }
 
   ngOnInit() {
-    this.http.get<{authenticated: boolean, username?: string, email?: string}>('/api/user').subscribe({
+    this.http.get<{ authenticated: boolean, username?: string, email?: string }>('/api/user').subscribe({
       next: (user) => {
         if (user.authenticated) {
           this._isLoggedIn.set(true);