Update dev workflow and org chart settings

backend/cmd/server/main.go

@@ -331,8 +331,10 @@ func main() {
 			ServiceAccount: getEnv("WORKS_ADMIN_OAUTH_CLIENT_SERVICE_ACCOUNT", ""),
 			PrivateKey:     worksmobilePrivateKey,
 			Scope:          getEnv("WORKS_ADMIN_OAUTH_SCOPE", "directory"),
+			TokenURL:       getEnv("WORKS_ADMIN_OAUTH_TOKEN_URL", ""),
 		},
 	)
+	configureWorksmobileClientFromEnv(worksmobileClient)
 	worksmobileService := service.NewWorksmobileSyncService(tenantService, userRepo, worksmobileOutboxRepo, worksmobileClient)
 	worksmobileRelayWorker := service.NewWorksmobileRelayWorker(worksmobileOutboxRepo, worksmobileClient)
 	go worksmobileRelayWorker.Start(context.Background())
@@ -898,3 +900,10 @@ func main() {
 		os.Exit(1)
 	}
 }
+
+func configureWorksmobileClientFromEnv(client *service.WorksmobileHTTPClient) {
+	if client == nil {
+		return
+	}
+	client.BaseURL = strings.TrimSpace(getEnv("WORKS_ADMIN_API_BASE_URL", ""))
+}

backend/cmd/server/worksmobile_config_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"baron-sso-backend/internal/service"
 	"os"
 	"path/filepath"
 	"testing"
@@ -37,3 +38,14 @@ func TestGetEnvFileOrValueFallsBackToRawEnv(t *testing.T) {
 		t.Fatalf("secret value = %q, want raw env value", got)
 	}
 }
+
+func TestConfigureWorksmobileClientFromEnvOverridesAPIBaseURL(t *testing.T) {
+	t.Setenv("WORKS_ADMIN_API_BASE_URL", "https://proxy.example.com/works")
+	client := service.NewWorksmobileHTTPClientWithTokens("", "")
+
+	configureWorksmobileClientFromEnv(client)
+
+	if client.BaseURL != "https://proxy.example.com/works" {
+		t.Fatalf("BaseURL = %q, want env override", client.BaseURL)
+	}
+}