Fix __ENV__ truncation; route API_BASE_URL through the same injection

Two gaps blocked http://flights-ui.devwebzavod.ru/ru/flights-map:

1. The inline <script>window.__ENV__=...</script> was written with the
   Leaflet tile template ('/map/api/tile/{z}/{x}/{y}.jpeg') embedded
   directly. Rspack's html-plugin pre-processes the children string and
   ate the '{z}' placeholder, truncating the injected JS literal to
   '/map/api/tile/{z' — MAP_TILE_URL on the client ended up broken and
   getEnv() fell back to the default.

   Escape every '{'/'}' inside the stringified value as '\u007B'/'\u007D'.
   JS decodes the Unicode escapes back to '{}' at parse time; the html
   plugin's template engine sees no placeholders to eat. Object-literal
   braces outside the string stay raw (Unicode escapes aren't valid in
   operator positions in JS source).

2. API_BASE_URL was still hard-defaulting to 'http://localhost:8080/api',
   so every dictionary fetch on the deployed cluster died with
   ERR_CONNECTION_REFUSED. Thread API_BASE_URL through the same
   PUBLIC_ENV_KEYS/html.tags path as MAP_TILE_URL, add matching Docker
   ARG/ENV, and forward it in deployment/build-docker.sh + k8s manifest.

The devwebzavod default for both is https://flights.test.aeroflot.ru
— where the real Aeroflot ingress terminates /map/api/** and /api/**.
Prod keeps overriding with same-origin URLs.

Dockerfile.react

@@ -26,6 +26,8 @@ COPY config/ config/
 # into the image if the cluster can't set env at runtime.
 ARG MAP_TILE_URL
 ENV MAP_TILE_URL=${MAP_TILE_URL}
+ARG API_BASE_URL
+ENV API_BASE_URL=${API_BASE_URL}
 
 RUN pnpm build:standalone