Hardcoded fallback `http://localhost:8000/chat` for back_agent URL — surprises in non-default deploys

[lturner73]

Description

Backend/orchestrator.py:29 falls back to http://localhost:8000/chat when REACT_AGENT_API_URL isn't set:

BACK_AGENT_API_URL = os.getenv("REACT_AGENT_API_URL", "http://localhost:8000/chat")

Steps to Reproduce

1. Deploy the orchestrator in a container where the back_agent runs on back-agent.svc.cluster.local:8000.
2. Forget to set REACT_AGENT_API_URL.
3. Orchestrator silently tries localhost:8000 and fails with a connection-refused — only visible deep in the logs.

Expected vs Actual

Expected: orchestrator fails fast at startup with a clear "REACT_AGENT_API_URL is required" message in any environment that doesn't have a back_agent listening on localhost:8000.

Actual: silent fallback that produces confusing connection errors per-request.

Environment

Reproducible in any container/k8s deployment. The default works fine for local single-machine dev (which is presumably why it's there) but it should be a "loud" default — log a warning when the fallback is in use, or require an explicit --allow-localhost-fallback flag.

Also worth noting: the env var name REACT_AGENT_API_URL is misleading — there's no React on either side of that wire. Suggest renaming to BACK_AGENT_URL for clarity. (Backwards-compat: read both for one release cycle.)