feat(deploy): configurable backend HOST + env-driven vite base/assetsDir

- backend: HOST env (default 127.0.0.1, dev-safe; 0.0.0.0 in container)
- frontend: VITE_BASE drives base/assetsDir/manifest for portal embedding
- backward compatible: no env => identical to previous behavior

backend/src/config.ts

@@ -1,5 +1,5 @@
 export interface AppConfig {
-  port: number; harnessDir: string; thtBin: string; piBin: string;
+  host: string; port: number; harnessDir: string; thtBin: string; piBin: string;
   authMode: "none" | "mock" | "oidc";
   defaults: { provider?: string; model?: string; thinking?: string };
   maxPiProcesses: number;
@@ -8,6 +8,7 @@ export interface AppConfig {
 }
 export function loadConfig(env: Record<string, string | undefined>): AppConfig {
   return {
+    host: env.HOST ?? "127.0.0.1",
     port: Number(env.PORT ?? 8787),
     harnessDir: env.THT_HARNESS_DIR ?? "../harness",
     thtBin: env.THT_BIN ?? "tht",

backend/src/server.ts

@@ -2,5 +2,5 @@ import { buildApp } from "./app.js";
 import { loadConfig } from "./config.js";
 const config = loadConfig(process.env);
 const app = buildApp(config);
-app.listen({ port: config.port, host: "127.0.0.1" })
+app.listen({ port: config.port, host: config.host })
   .then((addr) => console.log(`backend listening on ${addr}`));