fix(frontend): resolve API base URL at request time for production

Use same-origin /api in the browser so builds are not stuck with baked-in
localhost. Server-side fetches use INTERNAL_API_URL, NEXT_PUBLIC_API_URL, or
loopback. Centralize logic in lib/api-base.ts.

Made-with: Cursor

frontend/lib/api-base.ts

@@ -0,0 +1,12 @@
+/** Browser: `/api/...` (same origin). Server: INTERNAL_API_URL → NEXT_PUBLIC_API_URL → loopback. */
+export function apiUrl(path: string): string {
+  const p = path.startsWith("/") ? path : `/${path}`;
+  if (typeof window !== "undefined") {
+    return `/api${p}`;
+  }
+  const base =
+    process.env.INTERNAL_API_URL ||
+    process.env.NEXT_PUBLIC_API_URL ||
+    "http://127.0.0.1:4000/api";
+  return `${base}${p}`;
+}