build(deploy): relative API base and a same-origin /api proxy

Dockerfile

@@ -4,8 +4,14 @@ WORKDIR /app
 COPY package*.json ./
 RUN npm ci
 COPY . .
-# VITE_UDYAM_API_BASE_URL is unset here, so the compiled-in default
-# (http://udyamlinc-backend.lincpay/api/v1/udyam) is baked into the bundle.
+# Vite inlines this at build time, so it is a build arg and not a runtime env
+# var — changing it later means rebuilding the bundle, not restarting nginx.
+#
+# Relative on purpose. A bundle carrying no hostname serves from any domain and
+# is same-origin with the API that nginx proxies at /api/, so the deployment
+# never has a CORS origin to keep in sync.
+ARG VITE_UDYAM_API_BASE_URL=/api/v1/udyam
+ENV VITE_UDYAM_API_BASE_URL=$VITE_UDYAM_API_BASE_URL
 RUN npm run build
 
 # ── serve stage: nginx serving the static SPA on 5173 ──