fix(e2e): stop hardcoding localhost:8128 for API resets

demo.spec.ts, ui-redesign.spec.ts and interactive-elements.spec.ts all
hardcoded an absolute http://localhost:8128 base for their demo-reset
helpers, which silently pointed at the local dev API even when the suite
was pointed at a different target via MOBILITYOPS_PUBLIC_URL -- discovered
while running the suite against the actual Unraid deployment, where the
reset call kept hitting the local machine instead of the server and left
BK-DEMO-RETURN in whatever state a prior run had left it. Use relative
paths so the request fixture's configured baseURL is honoured everywhere.

frontend/e2e/demo.spec.ts

@@ -1,13 +1,11 @@
 import { expect, test, type APIRequestContext } from "@playwright/test";
 
-const API_BASE = process.env.MOBILITYOPS_API_URL ?? "http://localhost:8128";
-
 async function resetDemoData(request: APIRequestContext) {
-  const login = await request.post(`${API_BASE}/api/v1/demo/login`, {
+  const login = await request.post("/api/v1/demo/login", {
     data: { role: "operations_manager" },
   });
   expect(login.ok()).toBeTruthy();
-  const reset = await request.post(`${API_BASE}/api/v1/demo/reset`);
+  const reset = await request.post("/api/v1/demo/reset");
   expect(reset.ok()).toBeTruthy();
 }
 

frontend/e2e/interactive-elements.spec.ts

@@ -1,10 +1,8 @@
 import { expect, test, type APIRequestContext } from "@playwright/test";
 
 async function resetDemoData(request: APIRequestContext) {
-  await request.post("http://localhost:8128/api/v1/demo/login", {
+  await request.post("/api/v1/demo/login", { data: { role: "operations_manager" } });
-    data: { role: "operations_manager" },
+  await request.post("/api/v1/demo/reset");
-  });
-  await request.post("http://localhost:8128/api/v1/demo/reset");
 }
 
 test.describe.configure({ mode: "serial" });
@@ -248,20 +246,16 @@ test("rental employee role has a restricted nav and cannot reach manager-only pa
 
 test("rental employee direct API access to manager-only endpoints is rejected", async ({
   page,
-  request,
 }) => {
   await page.getByRole("button", { name: "Switch role" }).click();
   await page.getByRole("button", { name: "Open as Rental Employee" }).click();
   await expect(page).toHaveURL(/\/dashboard$/);
 
-  const cookies = await page.context().cookies();
+  // page.request shares the browser context's cookies, and (via the web container's
-  const sessionCookie = cookies.find((c) => c.name === "mobilityops_session");
+  // nginx /api/ proxy) works identically against localhost and the deployed server --
-  const cookieHeader = sessionCookie ? `${sessionCookie.name}=${sessionCookie.value}` : "";
+  // the backend API itself is never exposed directly on either.
-
   for (const path of ["/api/v1/data-quality/issues", "/api/v1/audit", "/api/v1/workflows"]) {
-    const response = await request.get(`http://localhost:8128${path}`, {
+    const response = await page.request.get(path);
-      headers: { Cookie: cookieHeader },
-    });
     expect(response.status(), path).toBe(403);
   }
 });

frontend/e2e/ui-redesign.spec.ts

@@ -1,10 +1,8 @@
 import { expect, test, type APIRequestContext } from "@playwright/test";
 
-const API_BASE = process.env.MOBILITYOPS_API_URL ?? "http://localhost:8128";
-
 async function resetDemoData(request: APIRequestContext) {
-  await request.post(`${API_BASE}/api/v1/demo/login`, { data: { role: "operations_manager" } });
+  await request.post("/api/v1/demo/login", { data: { role: "operations_manager" } });
-  await request.post(`${API_BASE}/api/v1/demo/reset`);
+  await request.post("/api/v1/demo/reset");
 }
 
 test.beforeEach(async ({ page, request }) => {