feat(ui): point the portal at Fusion via ui_gateway_url

Add var.ui_gateway_url so config.js can target the Fusion listener instead of the
backend /demo. Set to the Fusion /tokenize endpoint; the browser now runs the
full flow through the gateway (guardrail -> tokenize -> agent -> restore).
Requires Fusion to return CORS for the CloudFront origin (done).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

terraform/ui.tf

@@ -73,13 +73,18 @@ resource "aws_s3_object" "index" {
   content_type = "text/html"
 }
 
-# Injected config: the demo orchestrator endpoint the UI calls.
+# Injected config: the endpoint the UI posts to. Defaults to the backend /demo
+# round trip; set var.ui_gateway_url to point the browser at Fusion instead.
+locals {
+  ui_endpoint = var.ui_gateway_url != "" ? var.ui_gateway_url : "${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo"
+}
+
 resource "aws_s3_object" "config" {
   bucket       = aws_s3_bucket.ui.id
   key          = "config.js"
-  content      = "window.DEMO_ENDPOINT = \"${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo\";\n"
+  content      = "window.DEMO_ENDPOINT = \"${local.ui_endpoint}\";\n"
   content_type = "application/javascript"
-  etag         = md5("${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo")
+  etag         = md5(local.ui_endpoint)
 }
 
 output "ui_url" { value = "https://${aws_cloudfront_distribution.ui.domain_name}" }

terraform/variables.tf

@@ -50,3 +50,11 @@ variable "agent_runtime_arn" {
   type        = string
   default     = ""
 }
+
+# Where the browser UI posts. Empty -> backend /demo. Set to the Fusion endpoint
+# to run the portal through the gateway (Fusion must return CORS for the UI origin).
+variable "ui_gateway_url" {
+  description = "Endpoint the UI posts to (empty = backend /demo round trip)."
+  type        = string
+  default     = ""
+}