Server-side code (proxy.ts, SSR, API routes) now uses SUPABASE_INTERNAL_URL (http://supabase-kong:8000) instead of the external domain. This avoids hairpin NAT / DNS resolution issues where Docker containers can't reach their own external domain through the reverse proxy. Browser-side JS still uses the external URL (baked at build time).