feat(portal-shell): wire environment.ts per ADR-0018 (#90)

## Summary

First implementation step of ADR-0018. Create [`src/environments/environment.ts`](apps/portal-shell/src/environments/environment.ts) holding the two SPA per-environment values the ADR calls out — `bffApiBaseUrl` and `otlpEndpoint` — and replace the hard-coded URLs at the two SPA call sites that needed them.

## What changes

- **New `environment.ts`** with dev defaults (`http://localhost:3000/api` and `http://localhost:4318/v1/traces`). Header comment links to ADR-0018, documents the constraint that per-environment siblings must share the same shape, and notes that nothing here is a secret (the SPA bundle is public).
- **`observability/tracing.ts`** reads `environment.otlpEndpoint` for the exporter, and **derives** the `propagateTraceHeaderCorsUrls` regex from `environment.bffApiBaseUrl` — a future change to the BFF origin propagates `traceparent` to the right host automatically, no second edit needed.
- **`home-status.service.ts`** builds `/health` as `${environment.bffApiBaseUrl}/health`.

## What this PR explicitly does NOT do

- **No `environment.staging.ts` / `environment.prod.ts`** yet. The ADR says "ship later" for those, and the real prod / staging URLs are unknown until the infrastructure ADR lands. Dropping plausible-but-wrong URLs into the repo would be worse than waiting.
- **No `fileReplacements` configuration in `project.json`** — it depends on the per-environment files existing. Wired in the same PR that introduces them.
- **No BFF-side audit pool split** (`AUDIT_DATABASE_URL` validator, second Prisma client, boot-time UPDATE-rejection self-test). Also in the ADR's Confirmation list, but it touches `AuditModule` and deserves its own review. Separate PR.
- **No `SERVICE_VERSION` wiring** in `tracing.ts`. Still hard-coded to `'dev'`; the build-time version source (same one that will feed the footer's dev-only version badge) is its own small chantier.

## Test plan

- [x] `pnpm exec nx run-many -t lint test build --projects=portal-shell` — green (36 / 36 specs unchanged, no new tests needed).
- [x] Production build size unchanged (121 kB gzip initial — `environment.ts` is one literal object inlined by the bundler).
- [ ] Manual: `pnpm exec nx serve portal-shell` → home page loads, the health widget hits the BFF, Jaeger shows the SPA `document_load` + `fetch` + BFF child span trace.
- [ ] Manual: temporarily change `bffApiBaseUrl` to `http://localhost:9999/api` → the fetch fails (expected), and the `traceparent` propagation regex no longer matches `:3000` (verifiable in Network panel — header is absent on cross-origin requests).

---------

Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr>
Reviewed-on: #90

apps/portal-shell/src/environments/environment.ts

@@ -0,0 +1,34 @@
+/**
+ * Per-environment configuration for the SPA, per ADR-0018.
+ *
+ * This file holds the **dev defaults** and is the one checked in.
+ * Per-environment siblings (`environment.staging.ts`,
+ * `environment.prod.ts`) land alongside this file later; the
+ * production / staging build configurations in `project.json` declare
+ * a `fileReplacements` entry that swaps this file for the target one
+ * at build time.
+ *
+ * Constraint: every sibling must export an `environment` object of
+ * the same shape. TypeScript will catch missing keys at the
+ * consuming site once a sibling exists.
+ *
+ * Nothing here is a secret. The SPA is a static bundle; secrets that
+ * ever needed to live here would, by definition, be public. Per-user
+ * / per-tenant secrets live in the BFF session payload (ADR-0010).
+ */
+export const environment = {
+  /**
+   * Origin + prefix of the BFF HTTP API. The SPA prepends this to
+   * every backend call (`${bffApiBaseUrl}/health`, etc.) and derives
+   * the OTel trace-header propagation pattern from its origin (see
+   * `observability/tracing.ts`).
+   */
+  bffApiBaseUrl: 'http://localhost:3000/api',
+
+  /**
+   * OTLP/HTTP traces endpoint. Targets the Collector in
+   * `infra/local/dev.compose.yml`. CORS is enabled there — see
+   * `infra/local/otel-collector.yaml`.
+   */
+  otlpEndpoint: 'http://localhost:4318/v1/traces',
+};