feat(web): add simple auth UI + enable CORS for testing

frontend/next.config.ts

@@ -1,7 +1,21 @@
 import type { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
-  /* config options here */
+  // For local dev convenience. In production you should configure reverse proxy
+  // and set NEXT_PUBLIC_API_BASE to your public API origin.
+  async rewrites() {
+    // If the user sets NEXT_PUBLIC_API_BASE to "/api", we can proxy to backend
+    // from the Next.js server (SSR). This does NOT affect browser fetch.
+    const backendInternal = process.env.BACKEND_INTERNAL_URL;
+    if (!backendInternal) return [];
+
+    return [
+      {
+        source: "/api/:path*",
+        destination: `${backendInternal}/api/:path*`,
+      },
+    ];
+  },
 };
 
 export default nextConfig;