One rule for reaching the api, in the system-test stack too

[ExtraToast]

Parent

#1095

What to build

One shape for how the frontend reaches the api, in all three environments.

After #999, development and production both serve the api same-origin under /api. The system-test stack does not: docker-compose.ci.yml runs the production nginx image, and services/frontend/nginx.conf has no /api location, so .github/workflows/validate.yml builds that image with VITE_APP_URL=http://localhost:8080 and the tests drive a request path no developer and no visitor takes any more.

Give nginx.conf an /api location that proxies to the api and strips the prefix — the same rule as the Traefik middleware and the vite dev proxy. Then VITE_APP_URL has no remaining caller and can go, along with the resolveBaseURL() branch that reads it and the ARG VITE_APP_URL in the frontend Dockerfile.

The production image gains an /api location it does not use, since Traefik routes /api before the request reaches nginx. That is the cost, and it is also the point: the image behaves the same wherever it runs.

Acceptance criteria

• The production frontend image serves /api by proxying to the api with the prefix stripped
• The api hostname the image proxies to is configurable, since it differs between the compose stack and the cluster
• The system tests pass against a same-origin frontend, with no VITE_APP_URL
• VITE_APP_URL is gone: the env var, the build argument, the workflow input and the branch in resolveBaseURL()
• Traefik still wins on /api/* in production, so the nginx location is never consulted there
• One rule for stripping /api is stated in each of the three places that need it, each naming the others
• The frontend e2e suite runs green inside the project's own dev container, where VITE_APP_URL currently puts the api cross-origin and strips every role (absorbed from The frontend e2e suite cannot run in the dev container: VITE_APP_URL puts the api cross-origin and silently strips every role #853)

Blocked by

#999