fix(dev): proxy local API and restrict frontend upstream

frontend/vite.config.ts

@@ -4,6 +4,7 @@ import path from "path";
 
 export default defineConfig(() => {
   const embedBase = process.env.VITE_BASE; // "/datamart-builder/assets/" in embedded; undefined = standalone
+  const apiUpstream = process.env.THT_FRONTEND_API_UPSTREAM ?? "http://localhost:8787";
   return {
     plugins: [react()],
     // base: prefisso pubblico degli asset. Default "/" (standalone).
@@ -11,6 +12,15 @@ export default defineConfig(() => {
     // /datamart-builder/assets/ → frontend-root mappa 1:1 (niente /assets/assets/).
     base: embedBase ?? "/",
     build: { manifest: true, outDir: "dist", assetsDir: embedBase ? "" : "assets" },
+    server: {
+      proxy: {
+        "/api": {
+          target: apiUpstream,
+          changeOrigin: true,
+          rewrite: (path) => path.replace(/^\/api(?=\/|$)/, ""),
+        },
+      },
+    },
     resolve: { alias: { "@": path.resolve(__dirname, "./src") } },
   };
 });