Single VITE_API_URL replaces apiUrl+authUrl. Gateway URL for auth calls
is derived at runtime via apiUrl.replace(/\/aria$/, '').
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Path was /api/auth/users/me but the auth controller is at /auth/api/users/me.
Caused a CORS-then-404 error on every page load.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace cryptic SVG countdown circle with a clear labeled toggle switch
in ThreatEvents, DevicePosture, and PrecursorAlerts. State is persisted
to localStorage per-component (aria_threats_autoRefresh, aria_posture_autoRefresh,
aria_alerts_autoRefresh).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
johannes