feat(infra): single-file toggle between apps-profile dev modes

Reduce the apps-profile mode switch (localhost / VSCode tunnel vs
HTTPS hostname) to a single file: infra/local/.env. Today the
toggle requires editing both apps/portal-bff/.env (the four
ENTRA_*_REDIRECT_URI) and infra/local/.env (NX_SERVE_CONFIGURATION).
After this PR, apps/portal-bff/.env stays at its localhost defaults
regardless — native nx serve outside Docker keeps working untouched
— and infra/local/.env carries the entire mode-specific block.

- dev.compose.yml portal-bff service: the four ENTRA_*_REDIRECT_URI
  are added to the environment: block with
  ${VAR:-localhost-default} interpolation. Compose's environment:
  wins over env_file:, so the BFF inside the container sees the
  override when set and the localhost default otherwise.
- infra/local/.env.example: the trailing Apps block is restructured
  as two clearly-labelled profiles (Mode A — Localhost / DEFAULT;
  Mode B — HTTPS hostname, commented template).
- apps/portal-bff/.env.example: comment block above the redirect URI
  defaults now explains that they stay at localhost regardless and
  points at the compose-level override in infra/local/.env.
- infra/README.md: new "Switching between dev modes — localhost vs
  hostname" subsection between "Dockerised app dev mode" and
  "HTTPS dev-server setup" with a comparison table and per-mode
  step-by-step.

apps/portal-bff/.env.example

@@ -61,24 +61,22 @@ ENTRA_CLIENT_SECRET=replace_with_real_value
 # post-logout URL is where Entra sends the browser after RP-initiated
 # logout (typically the SPA landing page).
 #
-# The default values below match WSL-native dev (browser on the same
-# host as the BFF, accessing http://localhost:4200/). For the
-# ADR-0030 dockerised dev mode accessed via a hostname (e.g.
-# https://apf-portal.dev-jg.local:4200/), override these to point at
-# the SPA dev-server origin instead — `/api/auth/callback` is then
-# proxied to the BFF (see apps/portal-shell/proxy.conf.js):
+# The four `localhost` values below are the **WSL-native default** —
+# browser and BFF on the same host, `http://localhost:*` redirect
+# URIs (which Entra accepts as the only exception to its HTTPS rule).
+# Leave them here in this file regardless of how the docker `apps`
+# profile is being run.
 #
-#   ENTRA_REDIRECT_URI=https://apf-portal.dev-jg.local:4200/api/auth/callback
-#   ENTRA_POST_LOGOUT_REDIRECT_URI=https://apf-portal.dev-jg.local:4200/
-#   ENTRA_ADMIN_REDIRECT_URI=https://apf-portal.dev-jg.local:4300/api/admin/auth/callback
-#   ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI=https://apf-portal.dev-jg.local:4300/
-#
-# The `https:` scheme is mandatory for non-`localhost` hosts — Entra
-# rejects `http:` for anything else. See the "HTTPS dev-server setup"
-# section of infra/README.md for the dev-server TLS / mkcert setup.
-# Each override URI must also be registered in the Entra app
-# registration's Redirect URIs list (the BFF sends *one* of them per
-# auth request; Entra validates it is allowed).
+# For the ADR-0030 dockerised `apps` profile accessed via a
+# hostname (e.g. `https://apf-portal.dev-jg.local:4200/`), do NOT
+# edit these values — instead override them at the compose level
+# from `infra/local/.env`. Compose's `environment:` block on the
+# `portal-bff` service interpolates each of these four vars at
+# parse time and wins over `env_file:`, so the BFF in the container
+# sees the hostname URIs while native `nx serve` keeps reading
+# this file's localhost defaults. See
+# `infra/README.md` → "Switching between dev modes" for the
+# two-mode toggle.
 ENTRA_REDIRECT_URI=http://localhost:3000/api/auth/callback
 ENTRA_POST_LOGOUT_REDIRECT_URI=http://localhost:4200/
 # Admin portal — distinct callback per ADR-0020 §"Sessions — distinct