Add make dev-lan: the app on a host port, API proxied on the same origin

docker/compose.lan.yml

@@ -0,0 +1,19 @@
+# Direct LAN access — layered on top of compose.local.yml by `make dev-lan`.
+#
+# For reaching the app from a machine that cannot be given a DNS record or a
+# hosts entry. Traefik routes on the Host header and a bare IP matches no
+# router, so the frontend is published on a host port instead and proxies the
+# API on that same port: http://<host-ip>:${APP_PORT} is the whole app.
+services:
+
+  frontend:
+    ports: !override
+      - "${APP_PORT:-8080}:80"
+    volumes:
+      - ./nginx-api-proxy.conf:/etc/nginx/extra-conf.d/backend-not-found.conf:ro
+    build:
+      args:
+        # Empty on purpose: the client then addresses the API as a path on
+        # whichever origin served the page, so one build works through
+        # app.${DOMAIN}, the published port, and an ssh tunnel alike.
+        - VITE_API_URL=

docker/nginx-api-proxy.conf

@@ -0,0 +1,32 @@
+# Serves the API from the same origin as the SPA, replacing the 404 stub the
+# image ships. Traefik routes on the Host header, which a bare IP never
+# matches, so this is what makes http://<host-ip>:<port> a complete app: the
+# client asks for /api/v1/... on whatever origin served it, and never needs a
+# resolvable api.${DOMAIN} or a CORS allowance.
+
+location /api {
+    # Docker's embedded DNS, re-resolved: nginx otherwise pins the backend's
+    # address at startup and 502s for good once that container is recreated.
+    resolver 127.0.0.11 valid=10s ipv6=off;
+    set $backend_upstream http://backend:8000;
+    proxy_pass $backend_upstream$request_uri;
+
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    # The flow websocket (/api/v1/flows/ws) upgrades through here; passing the
+    # client's own Connection header covers both it and ordinary requests.
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $http_connection;
+    # A live socket outlives the 60s default by design.
+    proxy_read_timeout 1d;
+}
+
+# Unchanged from the stub: the API docs stay off the frontend's origin.
+location /docs {
+    return 404;
+}
+location /redoc {
+    return 404;
+}