Round 1 external access fix and platform filter upgrade

[Marvinxtuc]

Summary

This PR publishes SignalForge Round 1 external demo readiness as an isolated review branch.

It keeps the browser on same-origin /api/*, adds the Next Route Handler runtime proxy, upgrades platform filtering to a select, preserves approved demo query parameters across navigation, and adds/report-validates external smoke coverage.

Key changes

• Route browser API calls through the Next runtime proxy: Browser /api/* -> Next route handler -> FastAPI.
• Map /api/health to FastAPI /health while preserving existing backend business APIs.
• Use SERVER_API_BASE_URL=http://api:8000 for Docker runtime server-side proxying.
• Keep browser traffic off localhost:8000 for external access.
• Preserve projectId and sf_token across frontend navigation while stripping sf_token from backend proxy forwarding.
• Replace free-text platform filtering with a fixed select; Product Hunt submits product_hunt.
• Add external smoke validation with sf_token redaction and Round 1 audit reports.

Validation

• docker compose -f infra/docker-compose.yml build: PASS
• docker compose -f infra/docker-compose.yml up -d: PASS
• docker compose -f infra/docker-compose.yml run --rm api pytest: PASS, 123 passed
• docker compose -f infra/docker-compose.yml run --rm web npm run build: PASS
• python3 scripts/validate_no_secrets.py: PASS
• python3 scripts/validate_frontend_mvp.py --require-http: PASS
• curl -i http://localhost:3000/api/health: HTTP 200
• curl -i 'http://localhost:3000/api/projects?page_size=1': HTTP 200
• curl -i http://localhost:3000/api/settings/platforms: HTTP 200
• Real Cloudflare external smoke: PASS with sf_token=<redacted>

Go / No-Go

Round 1 result: GO for external demo validation only.

This is not a formal production release approval. sf_token remains a temporary demo access signal, and the Cloudflare quick tunnel used for verification has been stopped.

Rollback

git revert a7e29c1 e2bec7f 4a67c72 722d8fc
docker compose -f infra/docker-compose.yml down

Additional local-only note: validation generated Python __pycache__ entries; they were intentionally not deleted because file deletion requires separate approval.