fix(config): default API URLs to https schweitz.net domains

Browser clients run on machines other than the host, and the homelab is
retiring direct LAN IP:port access (ports move to loopback behind NPM),
so the 192.168.86.149 defaults would stop working. The public domains
work from anywhere; LAN clients bypass Authentik via source-IP rules.
LAN development can still override via --dart-define.

Portainer (9000) and Netdata (19999) defaults are left unchanged: no
*.schweitz.net proxy hosts exist for those services yet.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Default Core API and Tatlock API URLs now use the public domains
+  `https://api.schweitz.net` and `https://tatlock.schweitz.net` (previously LAN
+  `http://192.168.86.149:8083`/`:8000`), so default builds require OIDC auth;
+  override via `--dart-define` for direct LAN development
+
 ## [1.6.0] - 2026-01-08
 
 ### Added

lib/core/config/app_config.dart

@@ -1,35 +1,37 @@
 /// Application configuration from compile-time environment variables.
 ///
-/// ## Development (LAN - no auth required)
+/// ## Defaults (public URLs - auth required)
-/// Default values use LAN IPs for local development:
+/// Default values use the public https://*.schweitz.net domains so browser
+/// clients work from any machine (NPM fronts them; LAN clients bypass
+/// Authentik via source-IP rules):
 /// ```bash
 /// flutter run -d chrome
 /// ```
 ///
-/// ## Production (public URLs - auth required)
+/// ## Development (LAN - no auth required)
-/// Override with public URLs for production builds:
+/// Override with LAN URLs to hit services directly without OIDC:
 /// ```bash
-/// flutter build web \
+/// flutter run -d chrome \
-///   --dart-define=CORE_API_URL=https://api.schweitz.net \
+///   --dart-define=CORE_API_URL=http://192.168.86.149:8083 \
-///   --dart-define=TATLOCK_API_URL=https://tatlock.schweitz.net
+///   --dart-define=TATLOCK_API_URL=http://192.168.86.149:8000
 /// ```
 class AppConfig {
   AppConfig._();
 
   /// Core API base URL
-  /// - LAN default: No auth required
+  /// - Default: https://api.schweitz.net (requires OIDC)
-  /// - Production: https://api.schweitz.net (requires OIDC)
+  /// - LAN override: http://192.168.86.149:8083 (no auth)
   static const coreApiUrl = String.fromEnvironment(
     'CORE_API_URL',
-    defaultValue: 'http://192.168.86.149:8083',
+    defaultValue: 'https://api.schweitz.net',
   );
 
   /// Tatlock API base URL
-  /// - LAN default: No auth required
+  /// - Default: https://tatlock.schweitz.net (requires OIDC)
-  /// - Production: https://tatlock.schweitz.net (requires OIDC)
+  /// - LAN override: http://192.168.86.149:8000 (no auth)
   static const tatlockApiUrl = String.fromEnvironment(
     'TATLOCK_API_URL',
-    defaultValue: 'http://192.168.86.149:8000',
+    defaultValue: 'https://tatlock.schweitz.net',
   );
 
   /// Authentik OIDC discovery URL

test/core/config/app_config_test.dart

@@ -0,0 +1,15 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:tatlock_ui/core/config/app_config.dart';
+
+void main() {
+  group('AppConfig', () {
+    test('defaults to public schweitz.net API URLs', () {
+      expect(AppConfig.coreApiUrl, 'https://api.schweitz.net');
+      expect(AppConfig.tatlockApiUrl, 'https://tatlock.schweitz.net');
+    });
+
+    test('requiresAuth is true with default schweitz.net URLs', () {
+      expect(AppConfig.requiresAuth, isTrue);
+    });
+  });
+}