fix(web): bake API URL into proxy rewrites

[adrian-lorenzo]

What changes

• Make the web Docker image require and bake FACILITY_API_URL into Next.js rewrite rules.
• Pass the deployment API URL through infra/build-images.sh for AWS web builds.
• Pass the internal http://api:4400 URL through the documented Docker Compose build.
• Document the deployment-specific web image requirement and rebuild rule in both AWS runbooks.

Why

The production web image compiled its same-origin /api/* proxy with the localhost fallback. ECS supplied the public API URL only at runtime, so /api/auth/login attempted to reach 127.0.0.1:4400 and returned 500 even though the API service was healthy.

Verification

• pnpm verify passes locally
• Behaviour verified beyond the test suite (built the production linux/amd64 image and confirmed its routes-manifest.json contains https://api.facility.tam-os.com/:path*; rolled ECS web to task definition revision 2 and verified /api/auth/login returns 302 to GitHub; built facility-web through Docker Compose and confirmed its manifest contains http://api:4400/:path*)
• Documentation updated, or no user-facing change

pnpm verify was run with COMPOSE_ENV_FILES=.env.example so Docker Compose did not load deployment credentials from the local .env.