fix: use nginx reverse proxy to forward /api/* to backend at runtime

HuggingFace Spaces secrets are runtime env vars, not build-time args,
so Vite cannot bake VITE_API_BASE_URL into the bundle from HF secrets.
Instead, nginx proxies /api/* to ${VITE_API_BASE_URL}/api/* using
envsubst at container startup, keeping the frontend using relative paths.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -5,14 +5,10 @@ RUN corepack enable && corepack prepare pnpm@latest --activate
 
 WORKDIR /app
 
-COPY pnpm-workspace.yaml package.json pnpm-lock.json* ./
+COPY pnpm-workspace.yaml package.json pnpm-lock.yaml* pnpm-lock.json* ./
 RUN pnpm install --no-frozen-lockfile
 
 COPY . .
-
-ARG VITE_API_BASE_URL
-ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
-
 RUN pnpm build
 
 # Stage 2: Serve
@@ -20,16 +16,24 @@ FROM nginx:alpine
 
 COPY --from=builder /app/dist /usr/share/nginx/html
 
-# SPA fallback: route all requests to index.html
+# nginx config template — uses VITE_API_BASE_URL injected at runtime via envsubst
 RUN printf 'server {\n\
     listen 7860;\n\
     root /usr/share/nginx/html;\n\
     index index.html;\n\
+\n\
+    location /api/ {\n\
+        proxy_pass ${VITE_API_BASE_URL}/api/;\n\
+        proxy_set_header Host $http_host;\n\
+        proxy_set_header X-Real-IP $remote_addr;\n\
+    }\n\
+\n\
     location / {\n\
         try_files $uri $uri/ /index.html;\n\
     }\n\
-}\n' > /etc/nginx/conf.d/default.conf
+}\n' > /etc/nginx/conf.d/default.conf.template
 
-EXPOSE 7860
+# Entrypoint: substitute env vars into nginx config, then start nginx
+CMD ["/bin/sh", "-c", "envsubst '$VITE_API_BASE_URL' < /etc/nginx/conf.d/default.conf.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"]
 
-CMD ["nginx", "-g", "daemon off;"]
+EXPOSE 7860