feat(ui): point the portal at Fusion via ui_gateway_url

Add var.ui_gateway_url so config.js can target the Fusion listener instead of the
backend /demo. Set to the Fusion /tokenize endpoint; the browser now runs the
full flow through the gateway (guardrail -> tokenize -> agent -> restore).
Requires Fusion to return CORS for the CloudFront origin (done).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

terraform/variables.tf

@@ -50,3 +50,11 @@ variable "agent_runtime_arn" {
   type        = string
   default     = ""
 }
+
+# Where the browser UI posts. Empty -> backend /demo. Set to the Fusion endpoint
+# to run the portal through the gateway (Fusion must return CORS for the UI origin).
+variable "ui_gateway_url" {
+  description = "Endpoint the UI posts to (empty = backend /demo round trip)."
+  type        = string
+  default     = ""
+}