chore(audits): default the CDP audit scripts to the production bundle

Every audit script defaulted APP_URL to :3001, the Vite dev server. That
default is how the invalid captures removed in the previous commit were
produced in the first place: run the script, get dev-server data, archive it
as release evidence. Dev-mode Lighthouse perf is meaningless and the dev
bundle is not what ships.

All six now default to :3002 (production) and still honour APP_URL for
ad-hoc dev inspection. cdp-catalogue.mjs and cdp-diagnostic.mjs hardcoded
the URL outright and could not be pointed anywhere else; they now read
APP_URL and CDP_PORT like the rest.

Verified: all seven scripts pass `node --check`, and cdp-interaction.mjs
runs clean against production with no APP_URL set — 0 dark-mode contrast
failures, modal trap intact both directions, slider AX name PALETTE K with
range 3..64. Matches the committed evidence.