fix(web): proxy client API calls through Next.js to fix production connectivity

NEXT_PUBLIC_API_URL was undefined at build time, causing client bundles to
fall back to http://localhost:3001 — unreachable from the browser in prod.

- Add /api-proxy rewrite in next.config.ts (forwards to API_INTERNAL_URL at runtime)
- Bake NEXT_PUBLIC_API_URL=/api-proxy at build time in Dockerfile
- Fix api.ts to prefer API_INTERNAL_URL for server-side calls
- Fix docker-compose.prod.yml: set NEXT_PUBLIC_API_URL=http://api:3001 for runtime server-side code

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/Dockerfile

@@ -14,6 +14,7 @@ COPY --from=deps /app/ ./
 COPY apps/web/ ./apps/web/
 COPY packages/shared/ ./packages/shared/
 COPY tsconfig.base.json ./
+ENV NEXT_PUBLIC_API_URL=/api-proxy
 RUN pnpm --filter=@tessera/web build
 
 FROM node:24-alpine AS runner

apps/web/next.config.ts

@@ -5,6 +5,15 @@ const withNextIntl = createNextIntlPlugin('./src/i18n/request.ts');
 
 const nextConfig: NextConfig = {
   output: 'standalone' as const,
+  async rewrites() {
+    const apiUrl = process.env.API_INTERNAL_URL || 'http://localhost:3001';
+    return [
+      {
+        source: '/api-proxy/:path*',
+        destination: `${apiUrl}/:path*`,
+      },
+    ];
+  },
 };
 
 export default withNextIntl(nextConfig);

apps/web/src/lib/api.ts

@@ -5,7 +5,7 @@
  * All functions accept a cookie string for server-side auth forwarding.
  */
 
-const API_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:3001';
+const API_URL = process.env.API_INTERNAL_URL || process.env.NEXT_PUBLIC_API_URL || 'http://localhost:3001';
 
 /**
  * Module data shape from the API.

docker-compose.prod.yml

@@ -6,7 +6,7 @@ services:
       - "3000:3000"
     environment:
       HOSTNAME: "0.0.0.0"
-      NEXT_PUBLIC_API_URL: ${APP_URL:-http://localhost:3001}
+      NEXT_PUBLIC_API_URL: http://api:3001
       API_INTERNAL_URL: "http://api:3001"
       JWT_SECRET: ${JWT_SECRET}
     networks: