remove proxies and use native services w/cors

apps/www/wrangler.jsonc

@@ -13,7 +13,8 @@
 	// routing entirely, so the Worker runs ONLY for the listed patterns and every other
 	// path is served assets-first (with the SPA fallback → index.html). It must therefore
 	// list EVERY route the Worker handles, not just the new ones — otherwise `/api/*`
-	// falls through to index.html and the whole BFF breaks. Why it's needed at all: with
+	// falls through to index.html and both signup and the site config break (the SPA
+	// reads the other workers' hostnames from `/api/config`). Why it's needed at all: with
 	// SPA `not_found_handling`, a top-level *navigation* to a non-asset path (browsers
 	// send `Sec-Fetch-Mode: navigate`) is served index.html WITHOUT invoking the Worker,
 	// so a browser hitting `/docs` got the homepage. Keep this in sync with the Worker's
@@ -62,8 +63,11 @@
 	// created. A service binding skips the edge, so the real browser IP www forwards on
 	// that header survives (see src/upstream.ts `postAuthForm`).
 	//
-	// Only auth is bound: it's the only upstream whose behaviour depends on the caller's
-	// IP. accounts/api/img/notify still go over their public hostnames.
+	// Only auth is bound, and only for SIGNUP — the one call this worker still makes on
+	// the browser's behalf, because Turnstile's secret key can't ship to a page. Sign-in,
+	// the profile mutations and the photo feed are posted by the browser straight to
+	// auth/accounts/api/notify (as rec.net's own site did), where the edge sets the real
+	// client IP for free.
 	"services": [{ "binding": "AUTH", "service": "auth" }],
 	"upload_source_maps": true,
 	"observability": {
@@ -75,10 +79,11 @@
 	"vars": {
 		"ENVIRONMENT": "development", // overridden during deployment
 		"SENTRY_RELEASE": "unknown", // overridden during deployment
-		// Base domain the auth/accounts hosts are derived from (auth.<DOMAIN>,
-		// accounts.<DOMAIN>). Overridden at deploy time with the real RECFLARE_DOMAIN
-		// (see run-wrangler-deploy). For local dev, point this at a deployed domain so
-		// the BFF proxy can reach the auth/accounts workers.
+		// Base domain every worker hostname is derived from (auth.<DOMAIN>,
+		// accounts.<DOMAIN>, …). Overridden at deploy time with the real RECFLARE_DOMAIN
+		// (see run-wrangler-deploy). www serves these to the SPA via `/api/config`, which
+		// is how one client build works for any operator. For local dev, point it at a
+		// deployed domain so the page has real workers to call.
 		"DOMAIN": "rec.example.com"
 	}
 }