feat(spa): proxy /api in dev-server, relative bffApiBaseUrl

Make the SPAs reach the BFF same-origin via the Angular dev-server's
proxy, so the dockerised dev mode (ADR-0030) works when the SPA is
accessed from a remote browser (e.g. http://<vm-ip>:4200/) — and CORS
is bypassed in dev altogether.

- New proxy.conf.js per SPA: /api -> ${BFF_TARGET:-http://localhost:3000}
  (JS form so the env var can swap the target at startup without a
  rebuild).
- project.json serve.options.proxyConfig wired in for both apps.
- environment.ts (shell + admin) bffApiBaseUrl: 'http://localhost:3000/api'
  -> '/api'. Production siblings can still set an absolute origin if
  the SPA and BFF live on different hosts; tracing.ts resolves either
  form against window.location.origin.
- tracing.ts: new URL(env, window.location.origin) — relative bases no
  longer throw, absolute bases keep their own origin.
- dev.compose.yml: BFF_TARGET=http://portal-bff:3000 on portal-shell
  and portal-admin so the proxy hits the BFF container by Compose DNS.
  Native nx serve leaves it unset and falls back to localhost.

OTel exporter URL and cross-SPA links remain absolute — same remote-
browser issue, but not blocking the 'Backend unreachable' path this
PR targets. Out of scope here, follow-up if needed.

Stacked on top of feat/dockerised-dev-mode.

infra/local/dev.compose.yml

@@ -261,6 +261,11 @@ services:
   portal-shell:
     <<: *app-base
     container_name: apf-portal-shell-dev
+    environment:
+      # Read by apps/portal-shell/proxy.conf.js — points the dev-server
+      # /api proxy at the BFF container by name (Compose DNS). Native
+      # `nx serve` leaves BFF_TARGET unset and falls back to localhost.
+      BFF_TARGET: http://portal-bff:3000
     command: ['pnpm', 'exec', 'nx', 'serve', 'portal-shell', '--host', '0.0.0.0', '--port', '4200']
     ports:
       - '${SHELL_PORT:-4200}:4200'
@@ -271,6 +276,9 @@ services:
   portal-admin:
     <<: *app-base
     container_name: apf-portal-admin-dev
+    environment:
+      # See portal-shell — same proxy target for the admin SPA.
+      BFF_TARGET: http://portal-bff:3000
     command: ['pnpm', 'exec', 'nx', 'serve', 'portal-admin', '--host', '0.0.0.0', '--port', '4300']
     ports:
       - '${ADMIN_PORT:-4300}:4300'