# Task 024: Demo Browser API Reachability

Development description: Make the Docker Compose demo browser actions call the backend through a browser-reachable URL with CORS enabled, so Admin workflow editing and Editor article creation work during a live demo.

## Acceptance Criteria

- [x] Frontend server-side rendering still uses the internal Docker backend URL.
- [x] Browser-side frontend actions use a localhost backend URL mapped by Docker Compose.
- [x] Backend allows the demo frontend origin and `X-Demo-User-Email` header.
- [x] Admin workflow `Open` action works in the browser demo stack.
- [x] Editor article creation works in the browser demo stack.

## Result

- Status: Implemented.
- Added backend CORS middleware for demo frontend origins, configurable through `PIPELINE_CORS_ALLOW_ORIGINS`.
- Updated Docker Compose so `NEXT_PUBLIC_BACKEND_URL` points to `http://localhost:${BACKEND_PORT:-8000}` while `BACKEND_URL` remains `http://backend:8000` for server-side rendering.
- Switched browser-side API calls to same-origin `/api/*` through Next rewrites, keeping `BACKEND_URL=http://backend:8000` inside Docker.
- Fixed the Postgres article insert path by applying JSON casting to the workflow template snapshot column, not `publishing_status`.
- Updated Next 16 dynamic route adapters to await `params` and marked live-data pages dynamic.
- Added a public API integration test covering preflight for `http://localhost:13300` with `X-Demo-User-Email`.
- Verification:
  - `PYTHONPATH=/private/tmp/pupline-backend-deps python3 -m unittest apps.backend.tests.integration.test_demo_browser_cors_public_api -v` -> `Ran 1 test ... OK`.
  - `PYTHONPATH=/private/tmp/pupline-backend-deps python3 -m unittest apps.backend.tests.integration.test_workflow_template_binding_public_api apps.backend.tests.integration.test_demo_browser_cors_public_api -v` -> `Ran 5 tests ... OK`.
  - `pnpm typecheck` -> passed.
  - `BACKEND_URL=http://localhost:13800 FRONTEND_URL=http://localhost:13300 RUNNER_URL=http://localhost:13810 WAIT_SECONDS=120 bash tests/smoke/public-health.sh` -> `public health smoke ok`.
  - Browser smoke on Docker demo stack:
    - `/admin/workflows` -> Open seeded workflow -> stage editor loaded with 7 stages and no error.
    - `/articles/new` -> create article with active workflow -> redirect to article detail.
    - Article detail -> shows workflow template name, slug, version, 7-stage snapshot, and timeline.