feat(frontend): runtime backend URL via /config.js

Stop baking VITE_API_URL into the Vite build so one image can
run against any backend. Container entrypoint
(docker-entrypoint.d/30-frontend-config.sh, auto-run by the
nginx image) writes /usr/share/nginx/html/config.js from the
VITE_API_URL container env at every start; index.html loads
it before the bundle, and agent.ts prefers
window.__APP_CONFIG__ with the build-time env as fallback so
local dev and vite preview behave exactly as before.
public/config.js ships an empty placeholder for non-container
builds. Changing backends is now a restart with new env, no
rebuild.

docker-entrypoint.d/30-frontend-config.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# Generates runtime frontend config from container environment.
+# Runs automatically at container start via nginx's /docker-entrypoint.d/.
+# Lets one image talk to any backend: set VITE_API_URL on the service
+# (compose environment or .env) and restart — no rebuild needed.
+# The app (src/api/agent.ts) prefers this file, falling back to the
+# build-time VITE_API_URL when it is absent (local dev, vite preview).
+set -eu
+
+CONFIG_FILE="/usr/share/nginx/html/config.js"
+mkdir -p "$(dirname "${CONFIG_FILE}")"
+
+if [ -z "${VITE_API_URL:-}" ]; then
+  echo "frontend-config: VITE_API_URL not set, writing empty config (build-time env applies)"
+  printf 'window.__APP_CONFIG__ = {};\n' > "${CONFIG_FILE}"
+else
+  echo "frontend-config: writing config.js with VITE_API_URL=${VITE_API_URL}"
+  printf 'window.__APP_CONFIG__ = { VITE_API_URL: "%s" };\n' "${VITE_API_URL}" > "${CONFIG_FILE}"
+fi