Fix web/Dockerfile dropping two of its three VITE_* build args

Only VITE_API_BASE_URL had a matching ARG/ENV pair; docker-compose.yml's
build args for VITE_ALERTING_API_BASE_URL and
VITE_ENTERPRISE_AUTH_BASE_URL were silently dropped by Docker (an
undeclared --build-arg is dropped, not an error). enterpriseAuthBase
came out undefined in the built bundle, so the tenant-picker page threw
"enterprise-auth is not configured" against a real running container
even though docker-compose.yml looked correct. The other two vars masked
this because web/src/lib/api.ts's apiBase/alertingBase both have
hardcoded fallbacks that happen to match the intended values.

Found while wiring a real Auth0 developer tenant into enterprise-auth to
close §3a/§12's remaining "real external IdP" gap. Also gitignores
docker-compose.override.yml, since that's where such real credentials
belong for local testing -- never committed.

.gitignore

@@ -22,6 +22,10 @@ web/.svelte-kit/
 # Dev-only generated secrets
 hack/dev-certs/out/
 
+# Local overrides that may carry real credentials (e.g. a real OIDC/SAML
+# dev-tenant client secret for manual SSO testing) -- never committed.
+docker-compose.override.yml
+
 # OS / editor
 .DS_Store
 Thumbs.db

web/Dockerfile

@@ -7,11 +7,24 @@ WORKDIR /src
 COPY package.json package-lock.json ./
 RUN npm ci
 COPY . .
-# VITE_API_BASE_URL is baked in at build time — this is a prerendered
+# All three VITE_* vars are baked in at build time — this is a
-# static site, not a server. Override with --build-arg for non-default
+# prerendered static site, not a server. Override with --build-arg for
-# deployments.
+# non-default deployments. Each one needs its own ARG: an undeclared
+# --build-arg from docker-compose.yml's build.args is silently dropped
+# by Docker, not an error -- confirmed the hard way when
+# VITE_ALERTING_API_BASE_URL/VITE_ENTERPRISE_AUTH_BASE_URL were being
+# passed in but only VITE_API_BASE_URL was ever declared here, so the
+# other two never reached `npm run build` even though docker-compose.yml
+# looked correct. VITE_ENTERPRISE_AUTH_BASE_URL has no default (unlike
+# the other two) -- web/src/lib/api.ts treats it as intentionally
+# undefined when unset, meaning "enterprise-auth isn't deployed", not
+# "use some fallback host."
 ARG VITE_API_BASE_URL=http://localhost:8080
+ARG VITE_ALERTING_API_BASE_URL=http://localhost:8081
+ARG VITE_ENTERPRISE_AUTH_BASE_URL
 ENV VITE_API_BASE_URL=${VITE_API_BASE_URL}
+ENV VITE_ALERTING_API_BASE_URL=${VITE_ALERTING_API_BASE_URL}
+ENV VITE_ENTERPRISE_AUTH_BASE_URL=${VITE_ENTERPRISE_AUTH_BASE_URL}
 RUN npm run build
 
 # Not distroless: serving a static SPA needs *some* HTTP server, and