fix: make OPS_FRONTEND_URL configurable via environment variable

AGENTS.md

@@ -119,6 +119,7 @@ DB_PORT=55432 \
 BACKEND_PORT=58080 \
 FRONTEND_PORT=53000 \
 BACKEND_DOMAIN=http://localhost:58080 \
+OPS_FRONTEND_URL=http://localhost:53000 \
 docker compose --profile setup up --build
 ```
 
@@ -130,6 +131,9 @@ Port variables and their defaults:
 | `BACKEND_PORT` | `8080` | Flask API host port |
 | `FRONTEND_PORT` | `3000` | Frontend host port |
 | `BACKEND_DOMAIN` | `http://localhost:8080` | Backend URL used by the frontend container |
+| `OPS_FRONTEND_URL` | `http://localhost:3000` | Frontend origin allowed by backend CORS and Referer validation |
+
+> **Note:** `OPS_FRONTEND_URL` must match the origin the browser uses to reach the frontend. When `FRONTEND_PORT` is set, Compose derives `OPS_FRONTEND_URL` automatically (e.g., `FRONTEND_PORT=53000` → `http://localhost:53000`). Only set `OPS_FRONTEND_URL` explicitly when the browser uses a different host or scheme — otherwise login will fail with CORS errors.
 
 ### RSA Key Generation (Required Setup)
 

backend/ops_api/ops/environment/default_settings.py

@@ -29,7 +29,7 @@
 JWT_ENCODE_AUDIENCE = "https://opre-ops-frontend-dev"
 
 # OPS-FRONTEND
-OPS_FRONTEND_URL = "http://localhost:3000"
+OPS_FRONTEND_URL = os.getenv("OPS_FRONTEND_URL", "http://localhost:3000")
 
 AUTHLIB_OAUTH_CLIENTS = {
     "logingov": {

docker-compose.yml

@@ -63,6 +63,7 @@ services:
       - JWT_PRIVATE_KEY
       - JWT_PUBLIC_KEY
       - OPS_CONFIG=environment/local/container.py
+      - OPS_FRONTEND_URL=${OPS_FRONTEND_URL:-http://localhost:${FRONTEND_PORT:-3000}}
     volumes:
       - ./backend/ops_api/ops:/home/app/ops_api/ops
     depends_on: