Stop the flow store leaking git zombies, honour VITE_API_URL from .env

`FlowStore._git` now passes `-c gc.auto=0`, so `git commit` no longer forks a
background `gc --auto` that reparents onto PID 1 and stays there unreaped. With
auto-gc off nothing packs on its own, so `_commit` runs a foreground `git gc`
every 500 commits — the trigger a long-lived seeding session actually reaches.

`docker/compose.yml` takes the frontend's `VITE_API_URL` build arg from the
environment, keeping `https://api.${DOMAIN}` only as the fallback. `setup.sh`
already derives the scheme from `ENVIRONMENT`, so an `up --build` that does not
layer `compose.local.yml` stops shipping a bundle that calls `https://api.localhost`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01StpRc2C6au1WJ1EUU7fsfu

docker/compose.yml

@@ -173,7 +173,15 @@ services:
       context: ..
       dockerfile: frontend/Dockerfile
       args:
-        - VITE_API_URL=https://api.${DOMAIN?Variable not set}
+        # The address baked into the bundle. `scripts/setup.sh` already derives
+        # it from ENVIRONMENT and writes it to .env — http for a local target,
+        # because nothing terminates TLS there — so take it from the environment
+        # and keep the https form only as the default for a checkout that
+        # predates that key. Hardcoding https here made every `up --build` that
+        # did not also layer compose.local.yml ship a bundle calling
+        # https://api.localhost, which fails the certificate check and with it
+        # the whole login.
+        - VITE_API_URL=${VITE_API_URL:-https://api.${DOMAIN?Variable not set}}
         - NODE_ENV=production
     labels:
       - traefik.enable=true