fix(dev): proxy local API and restrict frontend upstream

docker/smoke/frontend-policy-smoke.sh

@@ -31,4 +31,27 @@ if rg -n 'BACKEND_BASE_URL|VITE_BACKEND_URL' docker/frontend-entrypoint.sh docke
   exit 1
 fi
 
+upstream_validator=docker/validate-frontend-api-upstream.sh
+for upstream in http://core:8787 http://core:8787/; do
+  if ! "$upstream_validator" "$upstream"; then
+    echo "frontend upstream validator rejected $upstream" >&2
+    exit 1
+  fi
+done
+
+for upstream in \
+  https://core:8787 \
+  http://core:8080 \
+  http://core:8787/api \
+  http://user:pass@core:8787 \
+  'http://core:8787?next=evil' \
+  'http://core:8787#fragment' \
+  'http://core:8787 injected' \
+  'http://core:8787;proxy_pass http://evil'; do
+  if "$upstream_validator" "$upstream" >/dev/null 2>&1; then
+    echo "frontend upstream validator accepted unsafe upstream: $upstream" >&2
+    exit 1
+  fi
+done
+
 echo "frontend same-origin proxy policy: ok"