Resolve ai-service directly from the RAG routes, never the gateway

.github/workflows/ci.yml

@@ -97,6 +97,26 @@ jobs:
       - name: Install
         run: pnpm install --frozen-lockfile
 
+      # api-gateway proxies /auth/* and nothing else (a single
+      # AuthProxyController). Preferring API_GATEWAY_URL in a RAG route
+      # therefore breaks chat, suggest, history, sections, section-text and
+      # feedback the moment apiGateway is enabled -- which is exactly what
+      # shipped in PR #27 and stayed invisible until the config was first
+      # rendered on 2026-08-19. Nothing else in CI would have caught it: the
+      # code compiles and lints fine, and it only misbehaves once a specific
+      # Helm value is set. Assert the boundary directly.
+      - name: Assert RAG routes never resolve through api-gateway
+        run: |
+          offenders=$(grep -rln 'API_GATEWAY_URL'             apps/web/app/api/chat             apps/web/app/api/suggest             apps/web/app/api/history             apps/web/app/api/sections             apps/web/app/api/section-text             apps/web/app/api/feedback || true)
+          if [ -n "$offenders" ]; then
+            echo "::error::RAG routes must use AI_SERVICE_URL, not API_GATEWAY_URL: $offenders"
+            exit 1
+          fi
+          # ...and auth must keep using it, or login silently talks to the
+          # wrong service instead.
+          grep -q 'API_GATEWAY_URL' apps/web/app/api/auth/login/route.ts
+          grep -q 'API_GATEWAY_URL' apps/web/app/api/auth/me/route.ts
+
       - name: Lint
         run: pnpm --filter @duoc-thu/web lint