fix local bootstrap startup and catalog widget UX

src/app/core/config/api-config.service.ts

@@ -19,12 +19,13 @@ export class ApiConfigService {
 
     if (this.tenantResolver.isLocalhost() && localhostUrl) {
       url = localhostUrl;
-    } else if (bootstrapUrl) {
-      url = bootstrapUrl;
     } else if (tenantMap?.[tenantKey]) {
       url = tenantMap[tenantKey];
     } else if (apiTemplate) {
       url = apiTemplate.replace('{tenant}', tenantKey);
+    } else if (bootstrapUrl) {
+      // Bootstrap API override is opt-in and only for absolute URLs.
+      url = bootstrapUrl;
     }
 
     return this.normalizeBaseUrl(url);
@@ -58,24 +59,33 @@ export class ApiConfigService {
   }
 
   private resolveBootstrapApiBaseUrl(): string | null {
+    const allowBootstrapApiOverride = (environment as any).allowBootstrapApiOverride === true;
+    if (!allowBootstrapApiOverride) {
+      return null;
+    }
+
     const bootstrap = this.configService.getBootstrapSnapshot() as any;
     if (!bootstrap) {
       return null;
     }
 
     const endpointBase = bootstrap?.apiEndpoints?.website?.baseUrl;
-    if (typeof endpointBase === 'string' && endpointBase.trim().length > 0) {
+    if (typeof endpointBase === 'string' && this.isAbsoluteHttpUrl(endpointBase)) {
       return endpointBase;
     }
 
     const tenantBase = bootstrap?.tenant?.apiBaseUrl;
-    if (typeof tenantBase === 'string' && tenantBase.trim().length > 0) {
+    if (typeof tenantBase === 'string' && this.isAbsoluteHttpUrl(tenantBase)) {
       return tenantBase;
     }
 
     return null;
   }
 
+  private isAbsoluteHttpUrl(url: string): boolean {
+    return /^https?:\/\//i.test(url.trim());
+  }
+
   private normalizeBaseUrl(url: string): string {
     if (!url || url === '/') {
       return '/';

src/app/core/providers/runtime-provider-strategy.service.ts

@@ -5,11 +5,25 @@ export type RuntimeProviderMode = 'mock' | 'api' | 'remote-config';
 
 @Injectable({ providedIn: 'root' })
 export class RuntimeProviderStrategyService {
+  private isLocalhost(): boolean {
+    if (typeof window === 'undefined') {
+      return false;
+    }
+
+    const host = window.location.hostname.toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1' || host === '::1';
+  }
+
   getBootstrapProviderMode(): RuntimeProviderMode {
     if (environment.useMockData) {
       return 'mock';
     }
 
+    // Local dev must use mocked bootstrap while API data can stay production-based.
+    if ((environment as any).useMockBootstrapOnLocal === true && this.isLocalhost()) {
+      return 'mock';
+    }
+
     return 'api';
   }