fix(ci): point both halves of a preview's account link at one SaaS

The browser read VITE_SAAS_API_URL from a variable while the backend kept its
compiled-in default, so the two could name different SaaS deployments - or the
frontend none at all while the log said "configured". Resolve one base and hand
it to both, with the prod default as the fallback, which also makes the variable
an optional override rather than something that has to be set.

Metering stated off: previews point at prod, and accrual there would spend a
real wallet. The 402 gate is independent of it and stays on.

Author: ConnorYoh

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -229,19 +229,29 @@ jobs:
         id: saas
         env:
           PROJECT_REF: ${{ secrets.SAAS_DB_PROJECT_REF }}
+          API_BASE_OVERRIDE: ${{ vars.SAAS_API_BASE_URL }}
         run: |
+          # One value for both halves. The browser's reads and the backend's register/entitlement
+          # calls have to land on the same SaaS, and nothing checks that they do. Optional, because
+          # the backend already defaults to prod - set it only to point a preview elsewhere.
+          API_BASE="${API_BASE_OVERRIDE:-https://stirling.com/app}"
+          echo "backend_base=${API_BASE}" >> "$GITHUB_OUTPUT"
+
           if [ -z "${PROJECT_REF}" ]; then
             echo "Not configured for this environment: the preview will build without a Stirling"
             echo "account, and the connect dialog will say so. To wire one up, set on the"
-            echo "pr-preview environment: secrets SAAS_DB_PROJECT_REF and"
-            echo "SAAS_SUPABASE_PUBLISHABLE_KEY (same Supabase project), and variable"
-            echo "SAAS_API_BASE_URL."
+            echo "pr-preview environment the secrets SAAS_DB_PROJECT_REF and"
+            echo "SAAS_SUPABASE_PUBLISHABLE_KEY, both from the same Supabase project."
+            # Moves with the Supabase pair, so an unconfigured preview stays wholly unconfigured
+            # instead of aiming its reads at an account it cannot sign in to.
             echo "supabase_url=" >> "$GITHUB_OUTPUT"
+            echo "frontend_base=" >> "$GITHUB_OUTPUT"
           else
             # Only whether, not which: the ref is a secret here, so Actions masks it out of any
             # line it appears in, derived URL included.
-            echo "Stirling account configured."
+            echo "Stirling account configured, at ${API_BASE}."
             echo "supabase_url=https://${PROJECT_REF}.supabase.co" >> "$GITHUB_OUTPUT"
+            echo "frontend_base=${API_BASE}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Check if image exists
@@ -272,7 +282,7 @@ jobs:
             BUILD_PORTAL=${{ env.BUILD_PORTAL }}
             VITE_SUPABASE_URL=${{ steps.saas.outputs.supabase_url }}
             VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY=${{ secrets.SAAS_SUPABASE_PUBLISHABLE_KEY }}
-            VITE_SAAS_API_URL=${{ vars.SAAS_API_BASE_URL }}
+            VITE_SAAS_API_URL=${{ steps.saas.outputs.frontend_base }}
           platforms: linux/amd64
 
       - name: Set up SSH
@@ -306,9 +316,12 @@ jobs:
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "false"
                 STIRLING_BILLING_ACCOUNT_LINK_ENABLED: "true"
+                STIRLING_BILLING_ACCOUNT_LINK_SAAS_BASE_URL: "${{ steps.saas.outputs.backend_base }}"
+                # Off so preview traffic never accrues against a real wallet or trips its cap. The
+                # 402 gate is separate and stays on, so gating is still testable here.
+                STIRLING_BILLING_ACCOUNT_LINK_METERING_ENABLED: "false"
                 # Stated rather than inferred from the request: the callback has to come back to the
                 # preview hostname, not to the container's own :8080 behind this proxy.
-                # account-link.saas-base-url is left alone; it already defaults to prod.
                 SYSTEM_FRONTENDURL: "https://${V2_PORT}.ssl.stirlingpdf.cloud"
                 SECURITY_ENABLELOGIN: "true"
                 SECURITY_INITIALLOGIN_USERNAME: "${TEST_LOGIN_USERNAME}"