feat: support configured production API endpoint

tests/test_auth.py

@@ -123,3 +123,64 @@ def test_whitelist_stand_invalid(monkeypatch):
         })()
     })())
     assert auth.get_polygon_stand() == "test"  # fallback
+
+
+def test_cloud_detection_includes_configured_prod_endpoint(monkeypatch):
+    from flask import Flask
+
+    prod_endpoint = "https://prod.example/api/v1/svc"
+    app = Flask(__name__)
+    app.config["NUBES_API_ENDPOINT"] = auth.STANDS[1]
+    app.config["NUBES_API_PROD_ENDPOINT"] = prod_endpoint
+    captured = {}
+
+    def fake_detect(token, endpoints):
+        captured["token"] = token
+        captured["endpoints"] = endpoints
+        return prod_endpoint
+
+    monkeypatch.setattr(auth, "detect_endpoint", fake_detect)
+    monkeypatch.setattr(auth, "current_app", app)
+    with app.test_request_context("/"):
+        assert auth._cached_detect("prod-token") == prod_endpoint
+
+    assert captured["token"] == "prod-token"
+    assert captured["endpoints"] == [*auth.STANDS, prod_endpoint]
+
+
+def test_detect_endpoint_tries_configured_prod_endpoint(monkeypatch):
+    from api import http_client
+
+    prod_endpoint = "https://prod.example/api/v1/svc"
+    endpoints = [*auth.STANDS, prod_endpoint]
+    attempted = []
+
+    class FakeHttpClient:
+        def __init__(self, endpoint, token):
+            self.endpoint = endpoint
+
+        def get(self, path, **kwargs):
+            attempted.append(self.endpoint)
+            if self.endpoint != prod_endpoint:
+                raise RuntimeError("token belongs to another stand")
+            return {"results": []}
+
+    monkeypatch.setattr(http_client, "HttpClient", FakeHttpClient)
+
+    assert http_client.detect_endpoint("prod-token", endpoints=endpoints) == prod_endpoint
+    assert attempted == endpoints
+
+
+def test_get_stand_labels_configured_prod_endpoint(monkeypatch):
+    from flask import Flask
+
+    prod_endpoint = "https://prod.example/api/v1/svc"
+    app = Flask(__name__)
+    app.config["NUBES_API_ENDPOINT"] = auth.STANDS[1]
+    app.config["NUBES_API_PROD_ENDPOINT"] = prod_endpoint
+    monkeypatch.setattr(auth, "get_mode", lambda: "cloud")
+    monkeypatch.setattr(auth, "get_token", lambda: "prod-token")
+    monkeypatch.setattr(auth, "_cached_detect", lambda token: prod_endpoint)
+    monkeypatch.setattr(auth, "current_app", app)
+
+    assert auth.get_stand() == "prod"