feat(portal-shell): wire environment.ts per ADR-0018

Create `src/environments/environment.ts` holding the two SPA
per-environment values referenced by ADR-0018: `bffApiBaseUrl`
(default `http://localhost:3000/api`) and `otlpEndpoint` (default
`http://localhost:4318/v1/traces`). The dev defaults match the
current local Docker compose stack — `nx serve portal-shell` keeps
working unchanged.

Replace the hard-coded URLs at the two call sites:

- `observability/tracing.ts` reads `environment.otlpEndpoint` for the
  OTLP exporter, and derives the `propagateTraceHeaderCorsUrls`
  regex from `environment.bffApiBaseUrl` — a future deploy-time
  change to the BFF origin propagates `traceparent` to the right
  place automatically.
- `home-status.service.ts` builds the `/health` URL as
  `${environment.bffApiBaseUrl}/health`.

Per-environment siblings (`environment.staging.ts`,
`environment.prod.ts`) and the `fileReplacements` configuration in
`project.json` land later — explicitly out of scope today per the
ADR ("ship later"); their values are not known yet and dropping
plausible-but-wrong production URLs into the repo would be worse
than waiting for the infrastructure ADR.

apps/portal-shell/src/environments/environment.ts

@@ -0,0 +1,34 @@
+/**
+ * Per-environment configuration for the SPA, per ADR-0018.
+ *
+ * This file holds the **dev defaults** and is the one checked in.
+ * Per-environment siblings (`environment.staging.ts`,
+ * `environment.prod.ts`) land alongside this file later; the
+ * production / staging build configurations in `project.json` declare
+ * a `fileReplacements` entry that swaps this file for the target one
+ * at build time.
+ *
+ * Constraint: every sibling must export an `environment` object of
+ * the same shape. TypeScript will catch missing keys at the
+ * consuming site once a sibling exists.
+ *
+ * Nothing here is a secret. The SPA is a static bundle; secrets that
+ * ever needed to live here would, by definition, be public. Per-user
+ * / per-tenant secrets live in the BFF session payload (ADR-0010).
+ */
+export const environment = {
+  /**
+   * Origin + prefix of the BFF HTTP API. The SPA prepends this to
+   * every backend call (`${bffApiBaseUrl}/health`, etc.) and derives
+   * the OTel trace-header propagation pattern from its origin (see
+   * `observability/tracing.ts`).
+   */
+  bffApiBaseUrl: 'http://localhost:3000/api',
+
+  /**
+   * OTLP/HTTP traces endpoint. Targets the Collector in
+   * `infra/local/dev.compose.yml`. CORS is enabled there — see
+   * `infra/local/otel-collector.yaml`.
+   */
+  otlpEndpoint: 'http://localhost:4318/v1/traces',
+};