fix(deploy): nginx /autobot-api→http :8001 + connection_upgrade map, distribute SLM_SECRET_KEY, SLM build VITE_API_URL=/slm (#10378, #10400, #10435)

[mrveiss]

Thinking Path

Three deploy-durability bugs where a live stopgap exists but the repo templates diverged. #10378: nginx /autobot-api/ proxied to https :8443 (nothing listens; co-located backend is http :8001) and hardcoded Connection "upgrade" (breaks REST). #10400: backend→SLM service-JWT signed with AUTOBOT_JWT_SECRET but SLM verifies with SLM_SECRET_KEY, never distributed → 4001. #10435: code-sync SLM-frontend rebuild ran plain npm run build without VITE_API_URL → vite guard hard-errors → silent stale dist.

What Changed

• autobot-slm.conf.j2 — added map $http_upgrade $connection_upgrade; /autobot-api/ co-located → http://autobot_backend/api/ (uvicorn :8001), standalone honours autobot_backend_protocol; Connection now $connection_upgrade. slm_manager/defaults/main.yml: autobot_backend_port 8443→8001, added autobot_backend_protocol: http.
• roles/backend/tasks/main.yml + backend.env.j2 — backend role now reads SLM_SECRET_KEY from /etc/autobot/slm-secrets.env and sets backend_jwt_secret (mirrors the fix(config): SLM_AUTH_TOKEN unset causes perpetual WebSocket 403 errors (4400+/day) #7689 SLM_AUTH_TOKEN read), so AUTOBOT_JWT_SECRET == SLM_SECRET_KEY every deploy. Same read added to update-all-nodes.yml's direct-template path.
• SLM-frontend build paths (role_registry.py post_sync, slm_manager task, role.json.j2, update-node.yml) → build:slm + VITE_API_URL=/slm (removed the broken VITE_API_URL='' conditional). User frontend untouched.

Verification

• python -m py_compile changed .py → OK; yamllint/yaml.safe_load on yml → OK; Jinja eyeballed (single-line, no >- folding).
• Closes bug(nginx): /autobot-api proxies to :8443 (https) but backend is http :8001 — 502 + hardcoded Connection upgrade #10378, bug(deploy): code-sync rebuild of autobot-slm-frontend fails silently — VITE_API_URL unset #10435 and the 4001 root-cause of bug(service-auth): backend→SLM WebSocket fails (403 handshake + 4001 token); JWT secret not distributed #10400.

Follow-up (not blocking)

#10400 403-handshake originates before the FastAPI route (uvicorn proxy / WS path on non-loopback) — needs live repro; will file a follow-up. Also update-all-nodes.yml never read SLM_AUTH_TOKEN (pre-existing #7689 gap) — follow-up candidate.

Model Used

Claude Opus 4.8 (devops-engineer subagent).

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!