Console nginx reverse proxy: route API calls to backend services

Console on :3010 now proxies all /api/v1/* requests to the correct
backend service via Docker Compose service names (drift, alert, portal,
cost, run). No CORS issues, no client-side port config needed.

products/console/Dockerfile

@@ -12,9 +12,84 @@ server {
     listen 80;
     root /usr/share/nginx/html;
     index index.html;
+
+    # SPA fallback
     location / {
         try_files $uri $uri/ /index.html;
     }
+
+    # Auth routes → alert service (any service works, they all share auth)
+    location /api/v1/auth/ {
+        proxy_pass http://alert:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+
+    # Drift API
+    location /api/v1/stacks {
+        proxy_pass http://drift:3000;
+        proxy_set_header Host $host;
+    }
+    location /api/v1/reports {
+        proxy_pass http://drift:3000;
+        proxy_set_header Host $host;
+    }
+    location /api/v1/dashboard {
+        proxy_pass http://drift:3000;
+        proxy_set_header Host $host;
+    }
+
+    # Alert API
+    location /api/v1/incidents {
+        proxy_pass http://alert:3000;
+        proxy_set_header Host $host;
+    }
+    location /api/v1/notifications {
+        proxy_pass http://alert:3000;
+        proxy_set_header Host $host;
+    }
+    location /api/v1/webhooks {
+        proxy_pass http://alert:3000;
+        proxy_set_header Host $host;
+    }
+
+    # Portal API
+    location /api/v1/services {
+        proxy_pass http://portal:3000;
+        proxy_set_header Host $host;
+    }
+
+    # Cost API
+    location /api/v1/anomalies {
+        proxy_pass http://cost:3000;
+        proxy_set_header Host $host;
+    }
+    location /api/v1/baselines {
+        proxy_pass http://cost:3000;
+        proxy_set_header Host $host;
+    }
+    location /api/v1/governance {
+        proxy_pass http://cost:3000;
+        proxy_set_header Host $host;
+    }
+    location /api/v1/ingest {
+        proxy_pass http://cost:3000;
+        proxy_set_header Host $host;
+    }
+    location /api/v1/cost {
+        proxy_pass http://cost:3000;
+        proxy_set_header Host $host;
+    }
+
+    # Run API
+    location /api/v1/runbooks {
+        proxy_pass http://run:3000;
+        proxy_set_header Host $host;
+    }
+    location /api/v1/approvals {
+        proxy_pass http://run:3000;
+        proxy_set_header Host $host;
+    }
 }
 EOF
 EXPOSE 80