feat(infra): single-file toggle between apps-profile dev modes

Reduce the apps-profile mode switch (localhost / VSCode tunnel vs
HTTPS hostname) to a single file: infra/local/.env. Today the
toggle requires editing both apps/portal-bff/.env (the four
ENTRA_*_REDIRECT_URI) and infra/local/.env (NX_SERVE_CONFIGURATION).
After this PR, apps/portal-bff/.env stays at its localhost defaults
regardless — native nx serve outside Docker keeps working untouched
— and infra/local/.env carries the entire mode-specific block.

- dev.compose.yml portal-bff service: the four ENTRA_*_REDIRECT_URI
  are added to the environment: block with
  ${VAR:-localhost-default} interpolation. Compose's environment:
  wins over env_file:, so the BFF inside the container sees the
  override when set and the localhost default otherwise.
- infra/local/.env.example: the trailing Apps block is restructured
  as two clearly-labelled profiles (Mode A — Localhost / DEFAULT;
  Mode B — HTTPS hostname, commented template).
- apps/portal-bff/.env.example: comment block above the redirect URI
  defaults now explains that they stay at localhost regardless and
  points at the compose-level override in infra/local/.env.
- infra/README.md: new "Switching between dev modes — localhost vs
  hostname" subsection between "Dockerised app dev mode" and
  "HTTPS dev-server setup" with a comparison table and per-mode
  step-by-step.

infra/local/.env.example

@@ -37,18 +37,27 @@ JAEGER_UI_PORT=16686
 SERVE_STATIC_PORT=4200
 
 # ---------------------------------------------------------------- Apps (`--profile apps`)
-# Nx serve configuration for the SPA dev-servers. Two values matter:
-#   - `development` (default) — plain HTTP. Use with `localhost`
-#                               browser access; Entra accepts
-#                               `http://localhost:*` redirect URIs.
-#   - `https`                 — TLS-terminating dev-server using the
-#                               cert at `.secrets/dev-tls.{key,pem}`.
-#                               Required when accessing the SPA via a
-#                               hostname (e.g. `apf-portal.dev.local`)
-#                               since Entra rejects `http:` for any
-#                               non-`localhost` redirect URI. See the
-#                               "HTTPS dev-server setup" section of
-#                               infra/README.md for the mkcert
-#                               procedure and how to wire the
-#                               matching `ENTRA_REDIRECT_URI` value.
+# Two access modes for the SPA dev-servers — pick one. The switch
+# happens entirely in this file (compose interpolates the SPA's nx
+# serve --configuration AND the BFF's ENTRA_*_REDIRECT_URI from here);
+# `apps/portal-bff/.env` stays at its localhost defaults regardless.
+# See infra/README.md → "Switching between dev modes".
+
+# === Mode A — Localhost / VSCode port-forwarding (DEFAULT) ===
+# Leave the entire Mode B block below commented. The SPA dev-servers
+# stay on plain HTTP, the BFF receives the `http://localhost:*`
+# redirect URIs already registered in Entra. Browse `http://
+# localhost:4200/` from the workstation — VSCode Remote-SSH auto-
+# forwards 4200 / 4300 / 3000 from the VM.
+
+# === Mode B — HTTPS via hostname (apf-portal.dev-XX.local) ===
+# Required when the SPA is accessed via a hostname (Entra refuses
+# `http:` for non-`localhost` redirect URIs — see the team mkcert CA
+# setup in infra/README.md). Replace `dev-jg` with YOUR hostname and
+# uncomment the five lines.
+#
 # NX_SERVE_CONFIGURATION=https
+# ENTRA_REDIRECT_URI=https://apf-portal.dev-jg.local:4200/api/auth/callback
+# ENTRA_POST_LOGOUT_REDIRECT_URI=https://apf-portal.dev-jg.local:4200/
+# ENTRA_ADMIN_REDIRECT_URI=https://apf-portal.dev-jg.local:4300/api/admin/auth/callback
+# ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI=https://apf-portal.dev-jg.local:4300/