dashboard: externalize service URLs and network config (Sprint 03 config externalization)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

dashboard/frontend/src/components/Sidebar.svelte

@@ -27,14 +27,22 @@
     { id: "security", label: "Security", icon: "shield" },
   ];
 
-  const LAN_IP = "192.168.31.222";
-  const TS_IP = "100.78.131.124";
+  let lanIp = $state("192.168.31.222");
+  let tsIp = $state("100.78.131.124");
   let lanReachable = $state(false);
+  let serviceUrls = $state({});
 
   if (typeof window !== "undefined") {
     fetch("/api/client-ip").then(r => r.json()).then(d => {
       if (d.lan) lanReachable = true;
     }).catch(() => {});
+
+    // Fetch external service URLs from backend config
+    fetch("/api/system/external-services").then(r => r.json()).then(d => {
+      if (d.lan_ip) lanIp = d.lan_ip;
+      if (d.ts_ip) tsIp = d.ts_ip;
+      if (d.services) serviceUrls = d.services;
+    }).catch(() => {});
   }
 
   const defaultMedia = [
@@ -197,10 +205,15 @@
   }
 
   function extHref(svc) {
-    if (lanReachable && svc.port) return `http://${LAN_IP}:${svc.port}`;
-    if (svc.remoteHref) return lanReachable ? svc.remoteHref : toPublicHttpsUrl(svc.remoteHref);
+    // Look up service URL from fetched config by label (lowercased, underscored)
+    const key = svc.label ? svc.label.toLowerCase().replace(/\s+/g, "_") : "";
+    const configUrl = serviceUrls[key];
+    const remoteHref = configUrl || svc.remoteHref;
+
+    if (lanReachable && svc.port) return `http://${lanIp}:${svc.port}`;
+    if (remoteHref) return lanReachable ? remoteHref : toPublicHttpsUrl(remoteHref);
     if (svc.port) {
-      const host = /^\d+\.\d+\.\d+\.\d+$/.test(location.hostname) ? location.hostname : TS_IP;
+      const host = /^\d+\.\d+\.\d+\.\d+$/.test(location.hostname) ? location.hostname : tsIp;
       return `http://${host}:${svc.port}`;
     }
     return svc.href;