test-frontend: refuse to run when the api container answers on another domain than the frontend

Makefile

@@ -175,7 +175,9 @@ PW_VERSION = $(shell sed -n 's/.*"@playwright\/test": "[^0-9]*\([0-9.]*\)".*/\1/
 # This suite creates and deletes flows, dashboards and users, so the hostname it
 # is pointed at is not taken from any file: it is read off the running stack
 # (the frontend container's own Traefik rule) and mapped onto the local Traefik
-# by address, so DNS never decides. tests/guard.ts is the second line.
+# by address, so DNS never decides. tests/guard.ts is the second line. The
+# suite calls api.<domain> even on a LAN stack, so an api container recreated
+# under another DOMAIN would answer every call with Traefik's 404.
 test-frontend:  ## Run frontend tests (Playwright e2e) against the local stack
 	@ip=$$(docker network inspect proxy \
 	  --format '{{range .Containers}}{{if eq .Name "fluksio-app-proxy-1"}}{{.IPv4Address}}{{end}}{{end}}' \
@@ -184,6 +186,9 @@ test-frontend:  ## Run frontend tests (Playwright e2e) against the local stack
 	domain=$$(docker inspect fluksio-app 2>/dev/null \
 	  | grep -o 'Host(`app\.[^`]*`)' | head -1 | sed 's/Host(`app\.//;s/`)//'); \
 	[ -n "$$domain" ] || { echo "  ✗ no running app stack to test — 'make dev' first"; exit 1; }; \
+	api=$$(docker inspect fluksio-api 2>/dev/null \
+	  | grep -o 'Host(`api\.[^`]*`)' | head -1 | sed 's/Host(`api\.//;s/`)//'); \
+	[ "$$api" = "$$domain" ] || { echo "  ✗ api container is on api.$${api:-?}, the app on app.$$domain — recreate the stack with 'make dev'"; exit 1; }; \
 	docker run --rm --network proxy --ipc=host \
 	  --user $$(id -u):$$(id -g) -e HOME=/tmp \
 	  --add-host app.$$domain:$$ip --add-host api.$$domain:$$ip \