fix and update

apps/frontend/lib/geocoding.ts

@@ -6,7 +6,7 @@ export interface ParsedAddress {
 }
 
 const NOMINATIM_HEADERS = {
-  'User-Agent': 'LendryID/1.0 (contact@lendry.ru)',
+  'User-Agent': 'MVKID/1.0 (sso@idpmvk.lpr)',
   Accept: 'application/json'
 };
 

apps/frontend/lib/oauth-url.ts

@@ -1,8 +1,14 @@
+import {
+  DEFAULT_PUBLIC_API_URL,
+  DEFAULT_PUBLIC_FRONTEND_URL,
+  inferApiBaseFromProjectDomain
+} from './project-domains';
+
 export function normalizeBaseUrl(url: string) {
   return url.trim().replace(/\/+$/, '');
 }
 
-export function resolveOAuthApiBase(settings: Record<string, string>, fallback = 'http://localhost:3002/idp-api') {
+export function resolveOAuthApiBase(settings: Record<string, string>, fallback = DEFAULT_PUBLIC_API_URL) {
   const publicApi = settings.PUBLIC_API_URL?.trim();
   if (publicApi) {
     return normalizeBaseUrl(publicApi);
@@ -10,16 +16,22 @@ export function resolveOAuthApiBase(settings: Record<string, string>, fallback =
 
   const domain = settings.PROJECT_DOMAIN?.trim();
   if (domain) {
+    const inferred = inferApiBaseFromProjectDomain(domain);
+    if (inferred) {
+      return inferred;
+    }
+
     if (domain.startsWith('http://') || domain.startsWith('https://')) {
       return normalizeBaseUrl(domain);
     }
+
     return `https://${domain.replace(/^\/+/, '')}/idp-api`;
   }
 
   return normalizeBaseUrl(fallback);
 }
 
-export function resolveFrontendBase(settings: Record<string, string>, fallback = 'http://localhost:3002') {
+export function resolveFrontendBase(settings: Record<string, string>, fallback = DEFAULT_PUBLIC_FRONTEND_URL) {
   const publicFrontend = settings.PUBLIC_FRONTEND_URL?.trim();
   if (publicFrontend) {
     return normalizeBaseUrl(publicFrontend);

apps/frontend/lib/project-domains.ts

@@ -0,0 +1,28 @@
+/** Публичные домены IdP (split-domain: API и SSO на разных хостах). */
+export const PROJECT_API_HOST = 'api.idpmvk.lpr';
+export const PROJECT_SSO_HOST = 'sso.idpmvk.lpr';
+
+export const DEFAULT_PUBLIC_API_URL = `https://${PROJECT_API_HOST}`;
+export const DEFAULT_PUBLIC_FRONTEND_URL = `https://${PROJECT_SSO_HOST}`;
+
+export function inferApiBaseFromProjectDomain(domain: string): string | null {
+  const host = domain
+    .trim()
+    .replace(/^https?:\/\//i, '')
+    .split('/')[0]
+    .toLowerCase();
+
+  if (!host) {
+    return null;
+  }
+
+  if (host.startsWith('sso.')) {
+    return `https://${host.replace(/^sso\./, 'api.')}`;
+  }
+
+  if (host.startsWith('api.')) {
+    return `https://${host}`;
+  }
+
+  return null;
+}

apps/frontend/lib/system-settings-catalog.ts

@@ -25,20 +25,20 @@ export const SYSTEM_SETTING_GROUPS: Record<string, string> = {
 export const SYSTEM_SETTING_CATALOG: SystemSettingMeta[] = [
   { key: 'PROJECT_NAME', label: 'Название проекта', group: 'general', type: 'text', hint: 'Отображается в меню, заголовке и боковой панели' },
   { key: 'PROJECT_TAGLINE', label: 'Слоган проекта', group: 'general', type: 'text' },
-  { key: 'PROJECT_DOMAIN', label: 'Домен IdP', group: 'general', type: 'text', hint: 'Домен без пути, например sso.example.ru' },
+  { key: 'PROJECT_DOMAIN', label: 'Домен IdP (SSO)', group: 'general', type: 'text', hint: 'Frontend-домен без пути, например sso.idpmvk.lpr' },
   {
     key: 'PUBLIC_API_URL',
     label: 'URL API (OAuth issuer)',
     group: 'general',
     type: 'text',
-    hint: 'Публичный URL, доступный из браузера пользователя. Не используйте api-gateway или другие Docker-имена. Пример: https://id.lendry.ru/idp-api'
+    hint: 'Публичный URL, доступный из браузера. Пример: https://api.idpmvk.lpr (отдельный домен API) или https://sso.idpmvk.lpr/idp-api (same-origin)'
   },
   {
     key: 'PUBLIC_FRONTEND_URL',
     label: 'URL Frontend IdP',
     group: 'general',
     type: 'text',
-    hint: 'Публичный адрес интерфейса IdP. Используется для login_url FedCM и popup OAuth'
+    hint: 'Публичный адрес UI IdP. Пример: https://sso.idpmvk.lpr'
   },
   {
     key: 'ONE_TAP_ENABLED',