fix: inject VITE_API_BASE_URL build arg in Dockerfile

Vite bakes env vars at build time. Without passing the HuggingFace
secret as a Docker build arg, VITE_API_BASE_URL compiled to an empty
string, causing all API requests to hit the frontend's own origin.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -9,6 +9,10 @@ COPY pnpm-workspace.yaml package.json pnpm-lock.json* ./
 RUN pnpm install --no-frozen-lockfile
 
 COPY . .
+
+ARG VITE_API_BASE_URL
+ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
+
 RUN pnpm build
 
 # Stage 2: Serve