docs(portal-self-service): serving/e2e decisions + walking-skeleton demo note (refs #68)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/frontend-decisions.md

@@ -72,3 +72,24 @@ with the submit form (S-08c, #67); any deviation from NL DS will be recorded her
 - **Module boundaries:** replaced the demo eslint `depConstraints` (`scope:shop`/`scope:shared`, left
   over from the Nx angular template) with a permissive `*` default; scope/type tags can be
   introduced when the portal set grows.
+
+---
+
+## Serving + e2e (S-08d, #68)
+
+- **Served by nginx, same-origin as the BFF.** The compose `self-service` image serves the built app
+  and **reverse-proxies** `/self-service/*` + `/openbaar/*` to the `bff` service. Because the
+  api-client uses **relative URLs**, the browser calls the app's own origin → nginx forwards to the
+  BFF: **no CORS**, and the DigiD token (same-origin) is attached by the interceptor. nginx resolves
+  the BFF at request time (a `resolver` + variable `proxy_pass`) so it starts before the BFF is up.
+- **Runtime config.** The app fetches `/config.json` before bootstrap (`main.ts`); `appConfig` is a
+  factory. The dev default (`public/config.json`) points at `localhost:8180`; the Docker image bakes
+  the compose value (`keycloak:8080`). One build, per-environment OIDC authority.
+- **e2e runs inside the compose network.** `infra/run-e2e-check.sh` runs Playwright in a `node`
+  container on `cg`, so the browser reaches Keycloak as `keycloak:8080` — the **same issuer** the BFF
+  validates against (resolves the browser-vs-container mismatch, ADR-0010). Chromium is installed at
+  runtime, so there's no Playwright-image-version pinning to keep in sync. The spec is copied in
+  (`docker cp`), not mounted, so it leaves nothing root-owned on the host. Wired as `verify-e2e` in
+  the `verify-stack` CI job.
+- `tests/e2e` is a standalone Playwright project (its own `package.json`), not an Nx project — it's a
+  live-stack check like the other `verify-*` runners, not part of the `frontend` unit lane.