ops: correct prod OpenTelemetry endpoint and ALLOWED_HOSTS in taskflow-deploy

In the live docker-compose.yml in nevridge/taskflow-deploy, compare the taskflow-api and taskflow-web environment settings with TaskFlow.Api/Extensions/OpenTelemetryServiceExtensions.cs and TaskFlow.Web/vite.preview.config.js. Apply the specified endpoint and host-setting changes in one deploy-repo commit, then redeploy. Record the before-and-after values and observations for site/API access, Seq logs and traces, metrics support, and Seq public access.

Groomed 2026-10-30 — ready for implementation.

Absorbs #358 (closed) and Part A of #357. The repo-side docs and test work stays in #357. The change itself is made in nevridge/taskflow-deploy, not in this repo; this issue tracks it.

Problem

Two production settings in the taskflow-deploy compose file do not match what this repo's code reads. Both were confirmed on 2026-10-30 by reading the live docker-compose.yml in nevridge/taskflow-deploy (images pinned at sha-5405774).

1. Doubled OTLP path. taskflow-api sets OpenTelemetry__Endpoint=http://seq:5341/ingest/otlp/v1/logs. TaskFlow.Api/Extensions/OpenTelemetryServiceExtensions.cs treats that value as a base URL and appends /v1/traces (line 46), /v1/metrics (line 58) and /v1/logs (line 99). Production therefore posts to .../ingest/otlp/v1/logs/v1/logs, .../v1/logs/v1/traces and .../v1/logs/v1/metrics. Dev and docker-compose.yml here use the base form http://seq:5341/ingest/otlp, which is what the code expects.
2. ALLOWED_HOSTS on the wrong container. taskflow-api sets ALLOWED_HOSTS=taskflow.skalaforge.com. Only the web preview server reads it (TaskFlow.Web/vite.preview.config.js, lines 1-2). Nothing in TaskFlow.Api reads it. taskflow-web has only API_TARGET, so the preview server runs with allowedHosts: true (any host accepted).

Not verified: whether Seq currently rejects the doubled path (and so whether production telemetry is arriving). Live Seq has deliberately not been queried.

User Story

As a TaskFlow operator, I want the production compose file to use the settings the code actually reads, so that production logs and traces reach Seq at the right URLs, and the host restriction applies to the container that enforces it.

Acceptance Criteria

1. Given the live docker-compose.yml in nevridge/taskflow-deploy, when the change is merged, then taskflow-api sets OpenTelemetry__Endpoint=http://seq:5341/ingest/otlp (no signal path, no trailing slash, never empty).
2. Given the same file, then ALLOWED_HOSTS is no longer set on taskflow-api, and taskflow-web sets ALLOWED_HOSTS=taskflow.skalaforge.com. (Default decision: move it. If the restriction is not wanted, remove it from taskflow-api and do not add it to taskflow-web; record that choice here.)
3. Given both edits, then they are made in one taskflow-deploy commit and picked up by one redeploy.
4. Given the redeployed stack, when I open https://taskflow.skalaforge.com and use the app, then the page loads and API calls through the web container's /api proxy succeed. (Traefik forwards the original Host header, so the host check passes.)
5. Given the redeployed stack, when the API handles traffic, then new API log records appear in Seq. Traces are checked as well. Whether Seq accepts OTLP metrics is checked against the Seq documentation and recorded here; absence of metrics in Seq is not a failure if Seq does not ingest them.
6. Given the work is done, then this issue records the values before and after, and what was observed for criteria 4 and 5.
7. Given the work is done, then this issue records whether taskflow-seq.skalaforge.com is readable without credentials (the live compose runs Seq with SEQ_FIRSTRUN_NOAUTHENTICATION=true behind a public Traefik route, with no middleware shown in the file). If it is open to the internet, file a separate issue; do not fix it here.

Edge Cases

• Rollback: revert the deploy-repo commit and let Portainer redeploy. Keep the previous values in this issue.
• A wrong ALLOWED_HOSTS value blocks legitimate requests. Check the site immediately after redeploy. The value is comma-separated, no scheme or port.
• Telemetry volume and shape change. The API starts exporting to the correct URLs for the first time, so Seq sees new traffic. Existing Seq queries or alerts may behave differently.
• Seq may reject or silently drop mis-pathed data. A "no data" check looks for the absence of recent records, not for errors in the API log.
• An empty OpenTelemetry__Endpoint bypasses the ?? fallback and throws at startup (new Uri("/v1/logs")). Do not set it empty.
• A value that already ends in a signal path is not handled by the API (a trailing slash is). A startup guard is a possible follow-up, not part of this issue.
• taskflow-api.skalaforge.com routes straight to the API and is unaffected by the ALLOWED_HOSTS move.

Out of Scope

• Docs and tests in this repo (#357).
• Other deploy-repo settings.
• Making the API accept, auto-correct or reject endpoints that include a signal path.
• gRPC or other OTLP protocol support.
• Seq authentication, dashboards or alerts (criterion 7 only records the finding).
• Querying live Seq as part of grooming (done by the operator at implementation time).