Keep the lan overlay when the frontend is rebuilt

`rebuild-frontend` already took the domain off the running stack, for exactly
the right reason — `VITE_API_URL` is baked in at build time, so rebuilding
under a different one leaves the SPA calling an API that answers elsewhere. It
then dropped `compose.lan.yml` regardless of whether the stack had been started
with it, which is the same mistake with a worse blast radius: that overlay is
what publishes the host port and what builds with an *empty* VITE_API_URL, and
it is the only way a wall panel reaches the app at all, since a screen on the
LAN cannot resolve app.${DOMAIN}. Rebuilding without it unpublished the port
and baked in a name that device cannot resolve — the panel went dark for an
hour and it took a log to see why.

Recognised by the published host port, because that is the one thing only that
overlay adds. Same shape as the domain sniffing above it: what is running is
the authority, not what happens to be typed on the command line.

Makefile

@@ -53,14 +53,30 @@ dev-lan:  ## Same, plus the app on http://<host-ip>:$(APP_PORT) (no DNS needed)
 	DOMAIN=$${DOMAIN:-localhost} ENVIRONMENT=$${ENVIRONMENT:-local} APP_PORT=$(APP_PORT) \
 	  $(COMPOSE_LAN) up --build -d proxy backend frontend mailcatcher
 
-# The frontend is an nginx image, so a UI change needs a rebuild. DOMAIN comes
-# off the running stack: VITE_API_URL is baked in at build time, and a rebuild
-# under a different domain leaves the SPA calling an API that answers elsewhere.
+# The frontend is an nginx image, so a UI change needs a rebuild. Both the
+# domain and the overlay set come off the *running* stack rather than from a
+# file: VITE_API_URL is baked in at build time, so rebuilding under a different
+# domain — or without the lan overlay a stack was started with — leaves the SPA
+# calling an API that answers elsewhere. The lan overlay is what publishes the
+# host port and builds with an empty VITE_API_URL, so dropping it takes a wall
+# panel reaching http://<host-ip>:$(APP_PORT) off the air entirely and bakes a
+# name it cannot resolve into the bundle. A published host port is how that
+# overlay is recognised, because it is the thing only that overlay adds.
 rebuild-frontend:  ## Rebuild and restart the local frontend (after a UI change)
 	@domain=$$(docker inspect fluksio-app 2>/dev/null \
 	  | grep -o 'Host(`app\.[^`]*`)' | head -1 | sed 's/Host(`app\.//;s/`)//'); \
+	port=$$(docker inspect fluksio-app \
+	  --format '{{range $$p, $$c := .NetworkSettings.Ports}}{{range $$c}}{{.HostPort}} {{end}}{{end}}' \
+	  2>/dev/null | awk '{print $$1}'); \
+	if [ -n "$$port" ]; then \
+	  echo "  lan stack detected (published on $$port) — keeping compose.lan.yml"; \
+	  compose="$(COMPOSE_LAN)"; \
+	else \
+	  compose="$(COMPOSE_LOCAL)"; \
+	fi; \
 	DOMAIN=$${domain:-$$DOMAIN} ENVIRONMENT=$${ENVIRONMENT:-local} \
-	  $(COMPOSE_LOCAL) up --build -d frontend
+	  APP_PORT=$${port:-$(APP_PORT)} \
+	  $$compose up --build -d frontend
 
 up:  ## Start the production stack
 	$(COMPOSE_PROD_RUN) up --build -d