nginx requires an explicit resolver when proxy_pass uses a variable.
Also enable proxy_ssl_server_name so TLS SNI works correctly when
proxying to the HTTPS backend on HuggingFace Spaces.
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
fix: use nginx reverse proxy to forward /api/* to backend at runtime
HuggingFace Spaces secrets are runtime env vars, not build-time args,
so Vite cannot bake VITE_API_BASE_URL into the bundle from HF secrets.
Instead, nginx proxies /api/* to ${VITE_API_BASE_URL}/api/* using
envsubst at container startup, keeping the frontend using relative paths.
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
fix: inject VITE_API_BASE_URL build arg in Dockerfile
Vite bakes env vars at build time. Without passing the HuggingFace
secret as a Docker build arg, VITE_API_BASE_URL compiled to an empty
string, causing all API requests to hit the frontend's own origin.
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
