fix(web-app): SW-Bypass für config.json + globalThis-Fallback in Config.kt

Co-authored-by: Junie <junie@jetbrains.com>

frontend/shells/meldestelle-portal/src/jsMain/kotlin/Config.kt

@@ -11,17 +11,27 @@ data class AppConfig(
 
 suspend fun loadAppConfig(): AppConfig {
     return try {
-        // Fetch config.json generated by Caddy templates
-        val response = window.fetch("/config.json").await()
+        // ?_nocache erzwingt einen SW-bypassing Request (SW sieht andere URL → Cache-Miss → Netzwerk)
+        val response = window.fetch("/config.json?_nocache=1").await()
         if (!response.ok) {
-            console.warn("[Config] Failed to load config.json, falling back to defaults")
-            return AppConfig(apiBaseUrl = window.location.origin)
+            console.warn("[Config] Failed to load config.json, falling back to globalThis")
+            return fallbackFromGlobal()
         }
         val text = response.text().await()
         Json.decodeFromString(AppConfig.serializer(), text)
     } catch (e: dynamic) {
         console.error("[Config] Error loading config:", e)
-        // Fallback for local development if file is missing
-        AppConfig(apiBaseUrl = "http://localhost:8081")
+        // Fallback: Caddy-injizierte Werte aus index.html (globalThis.API_BASE_URL / KEYCLOAK_URL)
+        fallbackFromGlobal()
     }
 }
+
+private fun fallbackFromGlobal(): AppConfig {
+    val apiBase = (js("globalThis.API_BASE_URL") as? String)
+        ?.takeIf { it.isNotBlank() && !it.startsWith("{{") }
+        ?: window.location.origin
+    val kcUrl = (js("globalThis.KEYCLOAK_URL") as? String)
+        ?.takeIf { it.isNotBlank() && !it.startsWith("{{") }
+    console.log("[Config] Fallback: apiBaseUrl=$apiBase, keycloakUrl=$kcUrl")
+    return AppConfig(apiBaseUrl = apiBase, keycloakUrl = kcUrl)
+}