[verified] route app-dev API through same-origin proxy

Dockerfile

@@ -61,6 +61,12 @@ RUN echo 'server { \
     proxy_set_header X-Real-IP $remote_addr; \
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; \
     } \
+    location /__ccapi/ { \
+    proxy_pass http://192.168.0.64:18000/; \
+    proxy_set_header Host $host; \
+    proxy_set_header X-Real-IP $remote_addr; \
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; \
+    } \
     location /api/ { \
     proxy_pass http://192.168.0.64:18000/api/; \
     proxy_set_header Host $host; \

docker-compose.dev.yml

@@ -16,8 +16,13 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        VITE_API_BASE: ${VITE_API_BASE:-}
+        # app-dev is served by nginx on the app host; browser API calls must stay
-        VITE_API_URL: ${VITE_API_URL:-}
+        # same-origin and pass through Dockerfile's /__ccapi proxy. The proxy
+        # strips that prefix before forwarding, preserving mixed backend routes
+        # such as /api/exam, /me/bootstrap, and /database/timetable.
+        # .env.dev still points at the LAN API for local Vite/dev tooling.
+        VITE_API_BASE: /__ccapi
+        VITE_API_URL: /__ccapi
         VITE_APP_NAME: ${VITE_APP_NAME:-Classroom Copilot}
         VITE_APP_HMR_URL: ${VITE_APP_HMR_URL:-}
         VITE_DEV: ${VITE_DEV:-false}