fix local bootstrap startup and catalog widget UX

src/app/core/config/api-config.service.ts

@@ -19,12 +19,13 @@ export class ApiConfigService {
 
     if (this.tenantResolver.isLocalhost() && localhostUrl) {
       url = localhostUrl;
-    } else if (bootstrapUrl) {
-      url = bootstrapUrl;
     } else if (tenantMap?.[tenantKey]) {
       url = tenantMap[tenantKey];
     } else if (apiTemplate) {
       url = apiTemplate.replace('{tenant}', tenantKey);
+    } else if (bootstrapUrl) {
+      // Bootstrap API override is opt-in and only for absolute URLs.
+      url = bootstrapUrl;
     }
 
     return this.normalizeBaseUrl(url);
@@ -58,24 +59,33 @@ export class ApiConfigService {
   }
 
   private resolveBootstrapApiBaseUrl(): string | null {
+    const allowBootstrapApiOverride = (environment as any).allowBootstrapApiOverride === true;
+    if (!allowBootstrapApiOverride) {
+      return null;
+    }
+
     const bootstrap = this.configService.getBootstrapSnapshot() as any;
     if (!bootstrap) {
       return null;
     }
 
     const endpointBase = bootstrap?.apiEndpoints?.website?.baseUrl;
-    if (typeof endpointBase === 'string' && endpointBase.trim().length > 0) {
+    if (typeof endpointBase === 'string' && this.isAbsoluteHttpUrl(endpointBase)) {
       return endpointBase;
     }
 
     const tenantBase = bootstrap?.tenant?.apiBaseUrl;
-    if (typeof tenantBase === 'string' && tenantBase.trim().length > 0) {
+    if (typeof tenantBase === 'string' && this.isAbsoluteHttpUrl(tenantBase)) {
       return tenantBase;
     }
 
     return null;
   }
 
+  private isAbsoluteHttpUrl(url: string): boolean {
+    return /^https?:\/\//i.test(url.trim());
+  }
+
   private normalizeBaseUrl(url: string): string {
     if (!url || url === '/') {
       return '/';