fix(auth): align service SSO routing

gitea/compose.yml

@@ -33,9 +33,15 @@ services:
       GITEA__database__HOST: db:5432
       GITEA__database__NAME: giteadb
       GITEA__database__USER: gitea
+      GITEA__server__PROTOCOL: http
+      GITEA__server__DOMAIN: gitea.xiteng.site
+      GITEA__server__ROOT_URL: https://gitea.xiteng.site/
       GITEA__server__SSH_PORT: 22
       GITEA__server__SSH_LISTEN_PORT: 22
       GITEA__server__SSH_DOMAIN: git.xiteng.site
+      GITEA__service__ENABLE_PASSWORD_SIGNIN_FORM: "false"
+      GITEA__service__ENABLE_BASIC_AUTHENTICATION: "false"
+      GITEA__service__ENABLE_PASSKEY_AUTHENTICATION: "false"
     volumes:
       - ./data:/data
       - ./custom/extra_links.tmpl:/data/gitea/templates/custom/extra_links.tmpl:ro
@@ -48,10 +54,14 @@ services:
       - "traefik.http.routers.gitea.rule=Host(`gitea.xiteng.site`)"
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
       - "traefik.http.routers.gitea.entrypoints=websecure"
+      - "traefik.http.routers.gitea.middlewares=gitea-scheme"
       # --- HTTP 入口（来自 cloudflared tunnel）---
       - "traefik.http.routers.gitea-http.rule=Host(`gitea.xiteng.site`)"
       - "traefik.http.routers.gitea-http.service=gitea"
       - "traefik.http.routers.gitea-http.entrypoints=web"
+      - "traefik.http.routers.gitea-http.middlewares=gitea-scheme"
+      # --- 中间件：强制 X-Forwarded-Proto（Cloudflare Tunnel 用 HTTP 连 Traefik，但用户端是 HTTPS）---
+      - "traefik.http.middlewares.gitea-scheme.headers.customrequestheaders.X-Forwarded-Proto=https"
       # --- 开启 TLS 并指定解析器 ---
       - "traefik.http.routers.gitea.tls=true"
       - "traefik.http.routers.gitea.tls.certresolver=cfresolver"