Default API_BASE_URL and PROD_ORIGIN to the test environment

Previously API_BASE_URL defaulted to http://localhost:8080/api, which
only works inside the dev server proxy. For standalone/SSR runs without
the proxy, the default now points to https://flights.test.aeroflot.ru.

Dev continues to use the same-origin proxy because scripts/dev-server.mjs
explicitly injects API_BASE_URL=http://localhost:8080/api into the
Modern.js child process env, keeping browser fetches CORS/WAF safe.

scripts/dev-server.mjs

@@ -25,11 +25,23 @@ const modernBin = resolve("node_modules", ".bin", "modern");
 const modernProcess = existsSync(modernBin)
   ? spawn(modernBin, ["dev"], {
       stdio: "inherit",
-      env: { ...process.env, PORT: String(MODERNJS_PORT) },
+      env: {
+        ...process.env,
+        PORT: String(MODERNJS_PORT),
+        // Point the browser bundle at the same-origin proxy so CORS/WAF stay
+        // bypassed. The proxy (this file) forwards to API_TARGET via curl.
+        API_BASE_URL: process.env.API_BASE_URL ?? "http://localhost:8080/api",
+      },
     })
   : spawn(process.execPath, [resolve("node_modules", "@modern-js/app-tools", "bin", "modern.js"), "dev"], {
       stdio: "inherit",
-      env: { ...process.env, PORT: String(MODERNJS_PORT) },
+      env: {
+        ...process.env,
+        PORT: String(MODERNJS_PORT),
+        // Point the browser bundle at the same-origin proxy so CORS/WAF stay
+        // bypassed. The proxy (this file) forwards to API_TARGET via curl.
+        API_BASE_URL: process.env.API_BASE_URL ?? "http://localhost:8080/api",
+      },
     });
 modernProcess.on("error", (err) => {
   console.error("Modern.js failed:", err);

src/env/env.test.ts

@@ -58,8 +58,9 @@ describe("getEnv", () => {
     const { getEnv, __resetEnvCacheForTests } = await import("./index.js");
     __resetEnvCacheForTests();
     const env = getEnv();
-    // API_BASE_URL defaults to same-origin proxy in dev when not set
-    expect(env.API_BASE_URL).toBe("http://localhost:8080/api");
+    // Default points to the test environment. Dev server overrides this to
+    // "http://localhost:8080/api" so browser calls route through the proxy.
+    expect(env.API_BASE_URL).toBe("https://flights.test.aeroflot.ru/api");
   });
 
   it("throws when NODE_ENV is not one of the allowed values", async () => {

src/env/index.ts

@@ -8,10 +8,12 @@ const boolish = z
 const EnvSchema = z.object({
   NODE_ENV: z.enum(["development", "test", "testing", "staging", "production"]).default("development"),
   BUILD_TARGET: z.enum(["standalone", "remote"]).default("standalone"),
-  PROD_ORIGIN: z.string().url().default("http://localhost:8080"),
-  // Same-origin /api — proxied by the dev server (scripts/dev-server.mjs)
-  // or by the production reverse proxy / CDN.
-  API_BASE_URL: z.string().url().default("http://localhost:8080/api"),
+  PROD_ORIGIN: z.string().url().default("https://flights.test.aeroflot.ru"),
+  // Defaults to the test environment. In dev, scripts/dev-server.mjs injects
+  // API_BASE_URL=http://localhost:8080/api so browser calls route through the
+  // same-origin curl-based WAF-bypass proxy. In production, a deployment-time
+  // env var should set this to the live API host.
+  API_BASE_URL: z.string().url().default("https://flights.test.aeroflot.ru/api"),
   SIGNALR_HUB_URL: z.string().url().default("http://platform.yc.webzavod.ru/tracker/hub"),
   OTEL_EXPORTER_OTLP_ENDPOINT: z.string().url().optional(),
   OTEL_EXPORTER_OTLP_HEADERS: z.string().optional(),