fix(oracle-r2): same-origin baseUrl + refresh actually re-fetches

Oracle round-2 review caught two real bugs:

1. Production baseUrl bypassed the nginx /api proxy
   - api.ts defaulted to https://demo.flow-master.ai in prod
   - Browser would hit cross-origin and CORS-fail
   - Now: baseUrl='' everywhere; nginx.conf already reverse-proxies /api/*
   - vite.config.ts proxy still handles dev

2. Refresh button didn't refresh
   - setMode('live') early-returned when already in live mode
   - Now: setMode() and refreshLive() share runLiveFetch(); refreshLive
     ignores the same-mode guard and always re-runs
   - 4 new vitest regressions in state/store.test.ts cover the contract
   - Smoke now asserts /api/ea2/work-items is called twice after Refresh

Also:
- buildScenarios.ts parallelized: cap N=6 candidates, Promise.all per-
  candidate fetches → live mode now ~3s instead of 30s
- CommandBar + LeftRail preview toasts now name the exact endpoint
  (/api/runtime/transactions/{id}/actions) in the visible text
- Landing 'Go live' button rebound to refreshLive() when already live;
  copy changed to 'Live · refresh'
- README: scenario table now renders (added separator row); deploy
  section points at the real ops PR + the actual overlay path
  (overlays/demo, not overlays/mc.flow-master.ai); CORS doc clarifies
  same-origin requirement

Constraint: browsers reject cross-origin → same-origin /api/* required
Rejected: dev/prod baseUrl divergence | created production bug
Confidence: high
Scope-risk: narrow
Not-tested: production image actually built + served by ops PR (gated by trusted updater + DNS)

src/components/CommandBar.tsx

@@ -17,12 +17,13 @@ export default function CommandBar() {
   const scenarios = useApp((s) => s.scenarios);
   const mode = useApp((s) => s.mode);
   const setMode = useApp((s) => s.setMode);
+  const refreshLive = useApp((s) => s.refreshLive);
   const pushToast = useApp((s) => s.pushToast);
 
   const sc = scenarioById(scenarioId);
 
   const previewAction = (label: string) => {
-    pushToast("info", `${label} is preview-only in this demo. Wire to /api/runtime/transactions to make it real.`);
+    pushToast("info", `${label} is preview-only. Wire to POST /api/runtime/transactions/{id}/actions to make it real.`);
   };
 
   useEffect(() => {
@@ -112,10 +113,17 @@ export default function CommandBar() {
           )}
 
           <Command.Group heading="Data mode">
-            <Command.Item onSelect={() => { setMode("live"); close(); }}>
-              <Refresh size={13} /> {mode === "live" ? "Refresh live scenarios" : "Switch to LIVE mode (fetch demo.flow-master.ai)"}
-              <span className="cmd-hint">{mode === "live" ? "re-fetch" : "in-browser"}</span>
-            </Command.Item>
+            {mode === "live" ? (
+              <Command.Item onSelect={() => { refreshLive(); close(); }}>
+                <Refresh size={13} /> Refresh live scenarios
+                <span className="cmd-hint">re-fetch demo.flow-master.ai</span>
+              </Command.Item>
+            ) : (
+              <Command.Item onSelect={() => { setMode("live"); close(); }}>
+                <Refresh size={13} /> Switch to LIVE mode (fetch demo.flow-master.ai)
+                <span className="cmd-hint">in-browser</span>
+              </Command.Item>
+            )}
             <Command.Item onSelect={() => { setMode("snapshot"); close(); }}>
               <Layers size={13} /> Switch to SNAPSHOT mode
               <span className="cmd-hint">bundled JSON</span>