v0.13.4 api update for deployment

doc/deployment.md

@@ -208,8 +208,10 @@ Browser clients are static files published by the host, and must match the
 server's API paths:
 
 - **Web client:** copy `internal/server/webserver/chess-client-web/`
-  (`index.html`, `app.js`, `style.css`) to the site directory. Without the
-  embedded `/config` endpoint, it uses the `/chess` API prefix.
+  (`index.html`, `app.js`, `style.css`) to the site directory. It takes its
+  API base from its script element, `<script src="app.js" data-api="…">`,
+  which the embedded server sets from `-web-api-url`; without one, as copied,
+  it uses the `/chess` API prefix.
 - **WASM terminal client (if published):** `make wasm` (xterm.js is committed
   under `lib/`), then copy `web/chess-client-wasm/`. It derives its API base
   as `<origin>/chess`. Its API paths are compiled into `chess-client.wasm`,

doc/development.md

@@ -37,7 +37,7 @@ go build ./cmd/chess-client-cli
 - `-finished-game-ttl`: How long terminal games stay in memory (default: `1h`; `0` disables eviction)
 - `-anonymous-game-ttl`: How long games without a registered player survive after their last activity, in memory and in the database (default: `24h`; `0` keeps them)
 - `-max-users`: Accounts at which public registration closes (default: `100`; `0` = no limit; the CLI is not limited)
-- `-web-api-url`: Browser-visible API origin for the embedded web client; useful when its public origin differs from the listen address
+- `-web-api-url`: Browser-visible API origin for the embedded web client, set on its script element as `data-api`; useful when its public origin differs from the listen address
 
 ### Modes
 ```bash

doc/todo.md

@@ -120,7 +120,8 @@ Constraints from the host's security headers:
   classes instead of inline style strings.
 - `img-src 'self' data:`: pieces remain Unicode glyphs or `data:` SVG.
 - `connect-src 'self'`: all requests go to the same origin under `/chess/`
-  (the existing `/config` fallback); no CDN or cross-origin API.
+  (the board's default API base, or the host's `data-api`); no CDN or
+  cross-origin API.
 - `frame-ancestors 'self'` and `X-Frame-Options: SAMEORIGIN`: the iframe host
   page must stay on the same origin. Downloads from `blob:` URLs and
   `navigator.clipboard` work in a same-origin frame.