feat(infra): single-file toggle between apps-profile dev modes

Reduce the apps-profile mode switch (localhost / VSCode tunnel vs
HTTPS hostname) to a single file: infra/local/.env. Today the
toggle requires editing both apps/portal-bff/.env (the four
ENTRA_*_REDIRECT_URI) and infra/local/.env (NX_SERVE_CONFIGURATION).
After this PR, apps/portal-bff/.env stays at its localhost defaults
regardless — native nx serve outside Docker keeps working untouched
— and infra/local/.env carries the entire mode-specific block.

- dev.compose.yml portal-bff service: the four ENTRA_*_REDIRECT_URI
  are added to the environment: block with
  ${VAR:-localhost-default} interpolation. Compose's environment:
  wins over env_file:, so the BFF inside the container sees the
  override when set and the localhost default otherwise.
- infra/local/.env.example: the trailing Apps block is restructured
  as two clearly-labelled profiles (Mode A — Localhost / DEFAULT;
  Mode B — HTTPS hostname, commented template).
- apps/portal-bff/.env.example: comment block above the redirect URI
  defaults now explains that they stay at localhost regardless and
  points at the compose-level override in infra/local/.env.
- infra/README.md: new "Switching between dev modes — localhost vs
  hostname" subsection between "Dockerised app dev mode" and
  "HTTPS dev-server setup" with a comparison table and per-mode
  step-by-step.

infra/local/.env.example

@@ -37,18 +37,27 @@ JAEGER_UI_PORT=16686
 SERVE_STATIC_PORT=4200
 
 # ---------------------------------------------------------------- Apps (`--profile apps`)
-# Nx serve configuration for the SPA dev-servers. Two values matter:
-#   - `development` (default) — plain HTTP. Use with `localhost`
-#                               browser access; Entra accepts
-#                               `http://localhost:*` redirect URIs.
-#   - `https`                 — TLS-terminating dev-server using the
-#                               cert at `.secrets/dev-tls.{key,pem}`.
-#                               Required when accessing the SPA via a
-#                               hostname (e.g. `apf-portal.dev.local`)
-#                               since Entra rejects `http:` for any
-#                               non-`localhost` redirect URI. See the
-#                               "HTTPS dev-server setup" section of
-#                               infra/README.md for the mkcert
-#                               procedure and how to wire the
-#                               matching `ENTRA_REDIRECT_URI` value.
+# Two access modes for the SPA dev-servers — pick one. The switch
+# happens entirely in this file (compose interpolates the SPA's nx
+# serve --configuration AND the BFF's ENTRA_*_REDIRECT_URI from here);
+# `apps/portal-bff/.env` stays at its localhost defaults regardless.
+# See infra/README.md → "Switching between dev modes".
+
+# === Mode A — Localhost / VSCode port-forwarding (DEFAULT) ===
+# Leave the entire Mode B block below commented. The SPA dev-servers
+# stay on plain HTTP, the BFF receives the `http://localhost:*`
+# redirect URIs already registered in Entra. Browse `http://
+# localhost:4200/` from the workstation — VSCode Remote-SSH auto-
+# forwards 4200 / 4300 / 3000 from the VM.
+
+# === Mode B — HTTPS via hostname (apf-portal.dev-XX.local) ===
+# Required when the SPA is accessed via a hostname (Entra refuses
+# `http:` for non-`localhost` redirect URIs — see the team mkcert CA
+# setup in infra/README.md). Replace `dev-jg` with YOUR hostname and
+# uncomment the five lines.
+#
 # NX_SERVE_CONFIGURATION=https
+# ENTRA_REDIRECT_URI=https://apf-portal.dev-jg.local:4200/api/auth/callback
+# ENTRA_POST_LOGOUT_REDIRECT_URI=https://apf-portal.dev-jg.local:4200/
+# ENTRA_ADMIN_REDIRECT_URI=https://apf-portal.dev-jg.local:4300/api/admin/auth/callback
+# ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI=https://apf-portal.dev-jg.local:4300/

infra/local/dev.compose.yml

@@ -240,6 +240,21 @@ services:
       DATABASE_URL: 'postgresql://${POSTGRES_USER:-portal}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-portal_dev}?schema=public'
       REDIS_URL: 'redis://default:${REDIS_PASSWORD}@redis:6379/0'
       OTEL_EXPORTER_OTLP_ENDPOINT: 'http://otel-collector:4318/v1/traces'
+      # OIDC redirect URIs. Driven by infra/local/.env so switching
+      # between the two access modes — `localhost` (default; VSCode
+      # Remote-SSH port-forwarding) and `https` hostname (the
+      # ADR-0030 mkcert path) — is a single-file change. Unset →
+      # localhost defaults; set in infra/local/.env to override with
+      # an `https://apf-portal.dev-XX.local:…` hostname. See the
+      # "Switching between dev modes" subsection of infra/README.md.
+      # Compose `environment` overrides `env_file`, so the BFF's
+      # own .env stays at localhost (so native `nx serve` works
+      # untouched) and only `infra/local/.env` carries the
+      # docker-apps-mode override.
+      ENTRA_REDIRECT_URI: ${ENTRA_REDIRECT_URI:-http://localhost:3000/api/auth/callback}
+      ENTRA_POST_LOGOUT_REDIRECT_URI: ${ENTRA_POST_LOGOUT_REDIRECT_URI:-http://localhost:4200/}
+      ENTRA_ADMIN_REDIRECT_URI: ${ENTRA_ADMIN_REDIRECT_URI:-http://localhost:3000/api/admin/auth/callback}
+      ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI: ${ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI:-http://localhost:4300/}
     # Secrets (Entra / session / jwks) come from the BFF's own dev env.
     # `required: false` so SPA-only devs can `up` without it — the BFF
     # then fails its own boot-time config validators with a clear message