One app surface, one API surface.
The app runs at https://staging.app.insight.ch5.me. The direct API runs at https://staging.api.insight.ch5.me. Browser-facing API paths are also mounted on the app host so session cookies and MCP auth stay aligned for testing.