chore: finish app-api → app-api-experimentation rename

Tail of 0f816d3 — `app-api.featbit.co` was already updated in the compose
stack and `.env.example`; this catches the remaining references in chart
values, the AKS example, web AUTH docs, the release runbook, and the
featbit-cli skill reference.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: cosmic-flood

RELEASING.md

@@ -39,7 +39,7 @@ The Helm chart is released separately (see "Chart release" below) — it depends
    - **version**: `0.4.0` (no leading `v` — the workflow validates SemVer)
    - **build-latest**: usually leave off; flip on for stable cuts you want `:latest` to follow.
 
-   The published web image targets any FeatBit backend at runtime via the `FEATBIT_API_URL` env var (defaults to `https://app-api.featbit.co`). One canonical image — no per-deployment rebuild required.
+   The published web image targets any FeatBit backend at runtime via the `FEATBIT_API_URL` env var (defaults to `https://app-api-experimentation.featbit.co`). One canonical image — no per-deployment rebuild required.
 2. Wait for all jobs to go green:
    - `preflight` validates the version and refuses if `v<version>` already exists.
    - `docker (featbit-rda-track-service)` and `docker (featbit-rda-web)` build multi-arch and push.

charts/featbit-rda/examples/aks/values.aks.local.yaml

@@ -87,7 +87,7 @@ trackService:
 # in CI with these args before bumping the tag below:
 #   docker build modules/web \
 #     --build-arg NEXT_PUBLIC_SANDBOX_URL=https://sandbox.featbit.ai \
-#     --build-arg NEXT_PUBLIC_FEATBIT_API_URL=https://app-api.featbit.co \
+#     --build-arg NEXT_PUBLIC_FEATBIT_API_URL=https://app-api-experimentation.featbit.co \
 #     -t featbitrdawu3.azurecr.io/featbit/web:0.1.0
 web:
   enabled: true

charts/featbit-rda/values.yaml

@@ -206,7 +206,7 @@ web:
   # default; self-hosters of github.com/featbit/featbit set this to their
   # own API URL. Server-only — never sent to the browser.
   featbit:
-    apiUrl: "https://app-api.featbit.co"
+    apiUrl: "https://app-api-experimentation.featbit.co"
 
   # PostgreSQL connection string for Prisma. Either set `connectionString`
   # (chart generates a Secret) or `existingSecret` to reference one you

modules/web/AUTH.md

@@ -21,7 +21,7 @@ Both paths terminate at the same PostgreSQL database. There is no separate auth
 
 ## Identity source: FeatBit backend
 
-All user identity comes from the FeatBit backend (`FEATBIT_API_URL`, default `https://app-api.featbit.co`). Server-only env var — the URL is never sent to the browser, which always goes through the same-origin `/api/featbit-proxy` route.
+All user identity comes from the FeatBit backend (`FEATBIT_API_URL`, default `https://app-api-experimentation.featbit.co`). Server-only env var — the URL is never sent to the browser, which always goes through the same-origin `/api/featbit-proxy` route.
 
 - **Login** (`POST /api/auth/login`) — forwards credentials to FeatBit `/identity/login`, which returns a short-lived JWT plus refresh cookies.
 - **Session storage** — the JWT and cookies are stored server-side in PostgreSQL (`AuthSession` table). The browser receives only an opaque `fb_session` HttpOnly cookie containing the session ID.
@@ -53,7 +53,7 @@ Next.js API route  →  loadSessionById(sessionId)  →  PostgreSQL AuthSession
   │
   ▼  bridgeFetch(path, { token, organizationId, workspaceId, ... })
   ▼
-FeatBit backend  (app-api.featbit.co)
+FeatBit backend  (app-api-experimentation.featbit.co)
 ```
 
 **Intentionally unprotected auth routes** (public by design):

skills/reversible-exposure-control/references/tool-featbit-cli.md

@@ -42,7 +42,7 @@ Config is stored outside the repository:
 
 Environment variable overrides (take precedence over config file): `FEATBIT_HOST`, `FEATBIT_TOKEN`, `FEATBIT_ORG`
 
-Default host if none provided: `https://app-api.featbit.co`
+Default host if none provided: `https://app-api-experimentation.featbit.co`
 
 All business commands accept `--host`, `--token`, and `--org` to override saved config on a single call without writing to disk.