9ca71ae92f
NEXT_PUBLIC_API_URL is read by the browser, not by the web container, so http://api:3001 could never work outside Docker. The test server had been corrected by hand long ago; the fix never came back here, so the file we would ship to a customer was the broken one. Also adopts the server's TESSERA_FORCE_CHANGE default of true, so a fresh install requires the initial admin password to be changed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>