chore(dev): serve the portal on 3000 for the Fayda redirect

The Fayda redirect URI registered for local testing is
http://localhost:3000/callback, matched exactly by the provider, so the portal
has to be the thing listening there. Its dev and preview servers move from 4200
to 3000 and the API moves to 3001.

Every hardcoded fallback to http://localhost:3000/api follows — six copies of
the same default across libs/api, libs/auth, the portal and the backoffice —
otherwise a developer without a .env would have had the app calling itself.

e2e is unaffected: it binds its own ports (3011/4302/4303) explicitly.

libs/api/src/lib/base-api/base-query-with-reauth.ts

@@ -5,7 +5,7 @@ import { resolveSessionContext } from "../session";
 export const BASE_API_URL =
   (import.meta as { env?: Record<string, string> }).env?.[
     "VITE_BASE_API_URL"
-  ] ?? "http://localhost:3000/api";
+  ] ?? "http://localhost:3001/api";
 
 let _onTokenExpired: (() => Promise<string>) | null = null;
 let _onAuthFailure: (() => void) | null = null;

libs/api/src/lib/features/licensing/licensing.helpers.ts

@@ -12,7 +12,7 @@ import type {
 
 const BASE_API_URL =
   (import.meta as { env?: Record<string, string> }).env?.['VITE_BASE_API_URL'] ??
-  'http://localhost:3000/api';
+  'http://localhost:3001/api';
 
 /**
  * Uploads a document straight to the API.

libs/api/src/lib/session/index.ts

@@ -11,7 +11,7 @@ export const SESSION_HEADER_KEYS = {
  * Which app this bundle is, so it reads its own session and no one else's.
  *
  * Set by each app's store via `configureSessionScope`. Cookies ignore the
- * port, so `localhost:4200` and `localhost:4201` share one jar: without a
+ * port, so `localhost:3000` and `localhost:4201` share one jar: without a
  * scope the backoffice would happily authenticate as whoever last signed into
  * the portal, and render a staff console with an applicant's permissions.
  */