fix(deploy): resolve the API base at request time, and stop shipping a secret

The Dokploy build failed at "Collecting page data for /api/assistant" with
"LOYALY_API_BASE is required in production". The guard was right; where it ran
was not.

  const BASE = resolveBase();   // evaluated on import

next build imports every route module to collect page data, the Docker builder
stage sets NODE_ENV=production, and LOYALY_API_BASE is a RUNTIME value that is
not present while an image is being built. So the check fired against the build
instead of against a misconfigured server. The previous comment claimed this
matched tokenStore's stance on AUTH_SECRET; it did not - tokenStore.key() is a
function, called per use. It is now genuinely the same shape: resolved on first
use and memoised, so building needs no platform host and serving still refuses
to guess one.

The value is also validated rather than merely present. It used to accept any
string, so platform.loyaly.ai - which serves THIS console, not the API - was
taken and only failed later as a contract_mismatch at first login. Production
is now an allowlist of exactly one origin, and the known-wrong host is rejected
everywhere with the reason attached, because "rejected" alone sends somebody
hunting for a firewall when the fix is one word in a variable. Development
stays permissive (LAN, tunnel, container host) minus that same host - nothing a
dev machine reaches is production.

  production   https://mcp.loyaly.ai only; missing, http://, platform.loyaly.ai,
               any other origin, a bare hostname and a non-http scheme all throw
  development  loopback and friends, or unset -> http://127.0.0.1:8088

An invalid or missing value is never cached, so a misconfigured process fails
identically on every request rather than once and then differently.

AUTH_SECRET is no longer an ENV line in the Dockerfile. A session-signing key
in git means anyone who can read the repo can forge a cookie for any user, and
every built image carried it in a layer `docker history` will print; Docker's
own linter flags the pattern. Both AUTH_SECRET and LOYALY_API_BASE are now
supplied by the orchestrator at runtime, and the file says so.

  ROTATE the old AUTH_SECRET - it remains in this repository's history.

Verified: docker build --no-cache with neither variable set compiles, passes
TypeScript and collects page data. The built container starts without them,
serves /login, and answers the first API call with the configuration error
naming the variable. With LOYALY_API_BASE set it reaches the real platform.
tsc clean; lint unchanged at the existing baseline.

REQUIRED in Dokploy before this deploys:
  LOYALY_API_BASE=https://mcp.loyaly.ai
  AUTH_SECRET=<openssl rand -base64 48>

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0161AMotQ8FxGPZ9gFGb5wiK

Dockerfile

@@ -35,14 +35,27 @@ ENV NEXT_TELEMETRY_DISABLED=1
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
 
-# Session-signing key. sessionToken.ts throws when this is unset under
-# NODE_ENV=production, which is why /api/auth/login answered 500 on valid
-# credentials while still returning 401/400 correctly on bad ones.
+# ── Runtime configuration: supplied by the orchestrator, never baked in ──
 #
-# This value is in git: anyone who can read the repo can forge a session
-# cookie for any user. Rotate by replacing it here (invalidates live
-# sessions), or move it to a Dokploy env var, which overrides this line.
-ENV AUTH_SECRET=a0123c7b1508b647cf0f3985ac95644f520d3bcb2695c96a85c3f5db8b0461da
+# Two variables are REQUIRED at runtime and are deliberately absent from this
+# image. Set them as Dokploy environment variables / secrets:
+#
+#   AUTH_SECRET       signs the session cookie and encrypts the platform token
+#                     bundle. Generate with: openssl rand -base64 48
+#   LOYALY_API_BASE   the Behavision API origin — https://mcp.loyaly.ai
+#                     (NOT platform.loyaly.ai, which serves this console)
+#
+# AUTH_SECRET used to be an ENV line here with a literal value, which put a
+# session-forging key in git: anyone who could read the repo could mint a
+# cookie for any user, and every built image carried it in a layer that
+# `docker history` prints. Docker's own linter flags the pattern
+# (SecretsUsedInArgOrEnv). It is gone; rotate the old value.
+#
+# Neither is needed to BUILD. LOYALY_API_BASE is resolved on first use rather
+# than at module load (see apiClient.ts), and sessionToken/tokenStore derive
+# their key per call, so page-data collection never reads either one. Both are
+# read on the first request that needs them, and a missing one fails loudly
+# there instead of silently guessing a host or a key.
 
 # Run as a non-root user; nextjs owns nothing it does not need to write.
 RUN addgroup -g 1001 -S nodejs && adduser -u 1001 -S nextjs -G nodejs