changes

Dockerfile

@@ -14,6 +14,25 @@ COPY package.json package-lock.json ./
 RUN npm ci --no-audit --no-fund
 
 COPY . .
+
+# The API origin, baked into the bundle at build time.
+#
+# Vite inlines VITE_* variables during `npm run build`; there is no runtime
+# configuration for a static bundle. It has to be an environment variable here
+# because .dockerignore excludes .env*, so no env file ever reaches this stage —
+# and without a value the client falls back to a relative /api/v1, which the
+# nginx runtime stage below serves as a static path. That answers a login POST
+# with 405 Method Not Allowed, because static file serving permits only
+# GET/HEAD.
+#
+# It must include the /api/v1 suffix: httpClient.js builds each URL as
+# `${API_BASE_URL}${path}` where path is `/auth/login`.
+#
+# Override per environment with:
+#   docker build --build-arg VITE_API_BASE_URL=https://other.example.com/api/v1 .
+ARG VITE_API_BASE_URL=https://mcp.krowforce.com/api/v1
+ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
+
 RUN npm run build
 
 # ---- Runtime stage ----