prefer same-origin api proxy

apps/web/app.js

@@ -1,8 +1,8 @@
-/* ProspectOS frontend MVP. Configure before loading with window.API_BASE = 'http://127.0.0.1:8000'; */
+/* ProspectOS frontend. Set window.__PROSPECT_CONFIG__.apiBase to an explicit API origin only when the UI is not served through the same-host /api proxy. */
 (() => {
   'use strict';
   const publicConfig = window.__PROSPECT_CONFIG__ || {};
-  const API_BASE = (publicConfig.apiBase || window.API_BASE || localStorage.getItem('prospect_api_base') || '').replace(/\/$/, '');
+  const API_BASE = (publicConfig.apiBase ?? window.API_BASE ?? '').replace(/\/$/, '');
   const endpoint = (path) => `${API_BASE}${path}`;
   let prospects = [], selectedId = null, selectedDetail = null, currentUser = null;
   let page = 1, pageSize = 10, hasNextPage = false, savedFilters = [], reviewQueue = [], selectedReviewIds = new Set();

apps/web/asset-manifest.json

@@ -5,7 +5,7 @@
   "publicAssets": ["index.html", "health.html", "error.html", "healthz"],
   "integrity": {
     "config.js": "sha256-20f3020432436dcccdbfc86fd56a6a6a49b71fc512a1e434187a5ddc134fda1c",
-    "app.js": "sha256-fc12f49012bb1329ffdd7bdcf655e9ab9097eaf1e0cc73cd0442b19fd57a0374",
+    "app.js": "sha256-1076064d78bad1debd3e890401f05b88bd4397d615799b7e983d734f8863fb9e",
     "styles.css": "sha256-7340dccc648fa917fb497ceeba7286d9c4712b6552960de54cef759cdbda6de4",
     "index.html": "sha256-37a9d5e2a81941c3c9f9bd3f42edf33a40565bf197cf675389d250dd60eb69db",
     "health.html": "sha256-c352a6f37aa24628cfc8d5709a70ff2d94181d192ed5fe00916cca9378a61d81",