fix(admin-auth): read GATEWAY_URL from process.env instead of build-time Vite var

Server-side gateway proxy (login, forgot-password, reset-password, all
/api/admin/* and /api/gateway/* calls) was reading import.meta.env.VITE_GATEWAY_URL,
which Vite only inlines at build time. The Dockerfile wrote GATEWAY_URL (no VITE_
prefix, and localhost besides) to .env at build time, so the var was never picked
up and the fallback http://localhost:9100 got baked into the server bundle
permanently — unreachable inside the pod, causing every admin auth call to 502
regardless of the correct GATEWAY_URL already set in the k8s ConfigMap.

Switch to process.env.GATEWAY_URL, read at runtime like the rest of the server
config already is.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -7,8 +7,8 @@ ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
 ENV CYPRESS_INSTALL_BINARY=0
 ENV NODE_ENV=production
 
-# Set API URL for build (create .env file)
-RUN echo "GATEWAY_URL=http://localhost:9100" > .env
+# GATEWAY_URL is resolved at runtime from the process environment (see
+# src/lib/server/gateway.ts), not baked in at build time.
 
 # Install build dependencies
 RUN apt-get update && apt-get install -y python3 make g++ git && rm -rf /var/lib/apt/lists/*

src/lib/server/gateway.ts

@@ -1,5 +1,8 @@
-// Server-side helper: all backend calls go through the Rust gateway
-const GATEWAY_URL = (import.meta.env.VITE_GATEWAY_URL || 'http://localhost:9100').replace(/\/+$/, '');
+// Server-side helper: all backend calls go through the Rust gateway.
+// Read from process.env (not import.meta.env) since this is server-only code and the
+// gateway URL differs per environment (k8s service DNS) — it must be resolved at
+// runtime, not baked in at build time.
+const GATEWAY_URL = (process.env.GATEWAY_URL || 'http://localhost:9100').replace(/\/+$/, '');
 
 export function gatewayUrl(path: string): string {
   const normalized = path.startsWith('/') ? path : `/${path}`;