feat: implement full bff logic

.env

@@ -0,0 +1,30 @@
+###> symfony/framework-bundle ###
+APP_ENV=dev
+APP_SECRET=changeme_generate_with_php_bin_console_secrets_generate_keys
+###< symfony/framework-bundle ###
+
+###> keycloak ###
+# Keycloak client registered for the BFF only (confidential client,
+# "Standard flow" + PKCE enabled, redirect URI = KEYCLOAK_REDIRECT_URI).
+# Apps never register their own Keycloak client — they all go through this one.
+KEYCLOAK_BASE_URL=https://keycloak.corp.internal
+KEYCLOAK_REALM=corp
+KEYCLOAK_CLIENT_ID=bff
+KEYCLOAK_CLIENT_SECRET=changeme
+KEYCLOAK_REDIRECT_URI=https://bff.corp.internal/auth/callback
+KEYCLOAK_POST_LOGOUT_REDIRECT=https://appsmith.corp.internal
+###< keycloak ###
+
+###> backend ###
+BACKEND_BASE_URL=https://backend.corp.internal/api
+# One env var per additional named backend, matching config/services.yaml's
+# `backends` map — requests select a non-default backend via the
+# X-Backend header, e.g.:
+# BACKEND_CRM_API_URL=https://crm-api.corp.internal
+###< backend ###
+
+###> appsmith apps ###
+# One line per Appsmith app you register — add more as you build more apps,
+# and add a matching line in config/services.yaml under appsmith.apps.
+APP_SANDBOX_LOGIN_URL=https://appsmith.corp.internal/app/sandbox/login-abc123
+###< appsmith apps ###