docs(api): publish only the sandbox base URL

[marioalvial]

Description

Two related changes to the published base URL:

1. Drop the internal service segment (/account, /payment, /webhook) from every server URL. The old faas.tracefinance.io/<service> form leaked the per-service routing of the gateway; partners only need the bare host plus the /api source channel that already prefixes every documented path.
2. Publish only the sandbox host. The production base URL is shared with each customer at go-live, after their integration is validated in sandbox. Exposing it in public docs gives the wrong contract and risks pointing partners at a host that may not be routed yet.

Net result: sandbox is https://api.sandbox.tracefinance.com; production is no longer present anywhere in the published surface.

The matching authoring rule in .claude/rules/openapi.md is also tightened so future spec changes cannot reintroduce either the service segment or a production URL.

Key Changes

• All three OpenAPI specs (apis/fx-account, apis/fx-payment, apis/fx-webhook): servers: reduced to a single sandbox entry on the bare host.
• docs.json: api.baseUrl collapsed to a single sandbox string; sandboxUrl updated; productionUrl variable removed.
• guides/environments.mdx: URL table replaced with a one-liner naming sandbox and explaining that the production URL is shared at go-live.
• webhooks/test-in-sandbox.mdx: removed a hardcoded URL literal that duplicated {{sandboxUrl}} and would have drifted on the next host change.
• .claude/rules/openapi.md: rule now (a) mandates the bare host with no service segment, and (b) forbids any production URL entry in specs, docs.json, or MDX.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

• Unit Test
• Integration Test

Validated locally with mint validate (passes) and mint broken-links (passes). Confirmed via grep that no faas. hostname remains and that api.tracefinance.com only survives inside the rule that forbids it.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules
• I have checked my code and corrected any misspellings

Backend / infra follow-up

The new public sandbox host must resolve and route to the gateway before this is announced to partners:

1. DNS: api.sandbox.tracefinance.com pointing at the FaaS gateway.
2. TLS cert covering the new name.
3. Gateway routing: requests to /api/... on the bare sandbox host must reach the same handlers that previously sat behind /account/api/..., /payment/api/..., /webhook/api/... on faas.sandbox.tracefinance.io.
4. Keep the legacy faas.sandbox.tracefinance.io/<service> host serving for a deprecation window; announce the cutover only after step 3 is verified end-to-end.
5. Production: equivalent DNS / TLS / routing must exist before any customer is given the production URL at go-live, but it does not need to be ready to merge this PR.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
tracefinance	🟢 Ready	View Preview	May 5, 2026, 5:45 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.