fix(oracle-r2): same-origin baseUrl + refresh actually re-fetches

Oracle round-2 review caught two real bugs:

1. Production baseUrl bypassed the nginx /api proxy
   - api.ts defaulted to https://demo.flow-master.ai in prod
   - Browser would hit cross-origin and CORS-fail
   - Now: baseUrl='' everywhere; nginx.conf already reverse-proxies /api/*
   - vite.config.ts proxy still handles dev

2. Refresh button didn't refresh
   - setMode('live') early-returned when already in live mode
   - Now: setMode() and refreshLive() share runLiveFetch(); refreshLive
     ignores the same-mode guard and always re-runs
   - 4 new vitest regressions in state/store.test.ts cover the contract
   - Smoke now asserts /api/ea2/work-items is called twice after Refresh

Also:
- buildScenarios.ts parallelized: cap N=6 candidates, Promise.all per-
  candidate fetches → live mode now ~3s instead of 30s
- CommandBar + LeftRail preview toasts now name the exact endpoint
  (/api/runtime/transactions/{id}/actions) in the visible text
- Landing 'Go live' button rebound to refreshLive() when already live;
  copy changed to 'Live · refresh'
- README: scenario table now renders (added separator row); deploy
  section points at the real ops PR + the actual overlay path
  (overlays/demo, not overlays/mc.flow-master.ai); CORS doc clarifies
  same-origin requirement

Constraint: browsers reject cross-origin → same-origin /api/* required
Rejected: dev/prod baseUrl divergence | created production bug
Confidence: high
Scope-risk: narrow
Not-tested: production image actually built + served by ops PR (gated by trusted updater + DNS)

src/App.tsx

@@ -19,6 +19,7 @@ export default function App() {
   const tourActive = useApp((s) => s.tour.active);
   const mode = useApp((s) => s.mode);
   const setMode = useApp((s) => s.setMode);
+  const refreshLive = useApp((s) => s.refreshLive);
   const liveLoading = useApp((s) => s.liveLoading);
   const liveFetchedAt = useApp((s) => s.liveFetchedAt);
 
@@ -80,7 +81,7 @@ export default function App() {
               {mode === "live" && liveAge && <span className="topbar-age">{liveAge}</span>}
             </button>
             {mode === "live" && (
-              <button className="link-btn" onClick={() => setMode("live")} disabled={liveLoading} title="Re-fetch live scenarios">
+              <button className="link-btn" onClick={refreshLive} disabled={liveLoading} title="Re-fetch live scenarios">
                 <Refresh size={12} /> Refresh
               </button>
             )}