Notepad: the https api origin is a compose default, not a stale image

Reopened with the actual trigger: the base compose builds the frontend
against https://api.${DOMAIN} and only compose.local.yml overrides it,
so any build without that layer breaks login locally. I closed this
earlier on the mistaken belief a rebuild had settled it.

NOTEPAD.md

@@ -18,6 +18,13 @@ Deferring because out of scope is fine, but don't mention deferring than.
   pixels than eighty and a third chart may now fit — worth measuring against the
   panel before adding one. The temperature history was the one dropped;
   `history.climate_*` still answers, so it is a tile away.
+- BUG/INFRA: `compose.yml` builds the frontend with `VITE_API_URL=https://api.${DOMAIN}`
+  and only `compose.local.yml` overrides it to `http`. Any `up --build` that does not layer
+  the local file therefore ships a bundle calling `https://api.localhost`, which fails with
+  `ERR_CERT_AUTHORITY_INVALID` and breaks login entirely — nothing terminates TLS locally.
+  It recurs every time the stack is brought up without the override, so it is not a stale
+  image but a default that is wrong for the local target. Either flip the default or make the
+  local target the one the Makefile always passes.
 - FEAT/UI: a bar's nested reading is captioned by its port name, which is
   chosen for the graph rather than for somebody reading it across a room.
   `Segment` now takes an optional `label`; the house dashboard sets one