declare the VITE args in the stage that builds

The build args were only in development-dependencies-env, which runs npm ci.
npm run build happens in build-env, and args do not cross stages -- so Vite has
never seen VITE_API_URL, VITE_GOOGLE_CLIENT_ID or VITE_COMMIT_SHA in any image
this Dockerfile has produced.

It went unnoticed because app/routes/*.tsx fall back to
https://api.t4t-gateway.com, which is correct for the VPS image and silently
wrong everywhere else: the homelab instance deployed today served a UI that
called production, exactly what building it separately was meant to prevent.
Verified from the served bundle -- assets/signup-*.js carried the VPS URL.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx

Dockerfile

@@ -19,6 +19,21 @@ WORKDIR /app
 RUN npm ci --omit=dev
 
 FROM public.ecr.aws/docker/library/node:20-alpine AS build-env
+
+# These have to be declared HERE, not only in development-dependencies-env:
+# build args do not cross stages, and this is the stage that runs `npm run
+# build`. Without them Vite inlines the fallbacks from app/routes/*.tsx --
+# https://api.t4t-gateway.com -- so an image built for anywhere else silently
+# drives production.
+ARG VITE_API_URL
+ENV VITE_API_URL=$VITE_API_URL
+
+ARG VITE_GOOGLE_CLIENT_ID
+ENV VITE_GOOGLE_CLIENT_ID=$VITE_GOOGLE_CLIENT_ID
+
+ARG VITE_COMMIT_SHA
+ENV VITE_COMMIT_SHA=$VITE_COMMIT_SHA
+
 COPY . /app/
 COPY --from=development-dependencies-env /app/node_modules /app/node_modules
 WORKDIR /app