Frontend: replace baked-in URL hack with runtime config injection

[BrewingCoder]

Problem

The frontend container currently uses a Python entrypoint that regex-replaces hardcoded default URLs baked into the JS bundle at build time (frontend-entrypoint.py). This is fragile and blocks:

• Helm/k8s deployment (Helm charts + MicroK8s deployment path #62): ConfigMaps and Secrets inject env vars into the container environment — they cannot reach into baked JS strings.
• .NET Aspire integration: Aspire's service discovery injects service URLs at orchestration time via env vars — same problem.
• Our own frontend build: We need our own image anyway (HoldFast branding, remove Highlight.io references). The upstream image + patch is explicitly a temporary workaround.

Solution

Implement a proper runtime config injection pattern:

1. Build the frontend with placeholder/empty values for all service URLs
2. Add a lightweight entrypoint script (bash or Node) that generates /build/env.js at container startup from actual env vars
3. index.html loads env.js before the bundle — sets window.__env__
4. App code reads window.__env__.REACT_APP_PRIVATE_GRAPH_URI (falling back to import.meta.env for local dev)

This makes the frontend a proper 12-factor app — all configuration via env vars, no runtime string replacement.

Scope

• Update src/frontend to read from window.__env__ with import.meta.env fallback
• New infra/docker/frontend-holdfast.Dockerfile that builds from source
• Replace frontend-entrypoint.py with a clean bash entrypoint that writes env.js
• Update compose.hobby-dotnet.yml to build from source
• HoldFast branding pass (remove Highlight.io references from UI)

Dependencies

• Blocks Helm charts + MicroK8s deployment path #62 (Helm/k8s) — frontend image must be env-var-clean before Helm charts are written
• Current upstream image + patch is acceptable only until this is done

[github-actions]

AI Triage: Replace Python entrypoint string replacement with proper runtime config injection via env.js to enable 12-factor deployment patterns for Kubernetes and .NET Aspire.

Labels applied: area:frontend, tech-debt, priority:high, component:docker