fix: override CORS_ORIGIN and redirect URI in dev to prevent prod redirect

apps/api/package.json

@@ -7,7 +7,7 @@
   "scripts": {
     "build": "prisma generate && tsc -p tsconfig.json",
     "db:push": "prisma db push",
-    "dev": "op run --env-file=./prod.env -- tsx watch src/index.ts",
+    "dev": "op run --env-file=./prod.env -- sh -c 'CORS_ORIGIN=http://localhost:5173 DISCORD_REDIRECT_URI=http://localhost:3898/auth/callback tsx watch src/index.ts'",
     "lint": "eslint --max-warnings 0 src",
     "start": "op run --env-file=./prod.env -- node prod/src/index.js",
     "test": "vitest run --coverage"

apps/api/src/routes/game.ts

@@ -890,7 +890,6 @@ const validateAndSanitize = (
    * Vampire state: preserve server-only currencies (ichor, soul shards, blood) at
    * previous values, and apply the same forward-only rules to bosses/quests/achievements
    * and exploration materials that the mortal and goddess realms use.
-   * Blood income will be computed and allowed to grow once Chunk 7 adds vampire tick logic.
    */
   // eslint-disable-next-line capitalized-comments -- v8 ignore
   /* v8 ignore next 160 -- @preserve */

apps/api/src/services/discord.ts

@@ -8,7 +8,9 @@
 import { logger } from "./logger.js";
 
 const discordClientId = "1479551654264049908";
-const discordRedirectUri = "https://elysium.nhcarrigan.com/api/auth/callback";
+const discordRedirectUri
+  = process.env.DISCORD_REDIRECT_URI
+  ?? "https://elysium.nhcarrigan.com/api/auth/callback";
 
 interface DiscordTokenResponse {
   access_token:  string;