fix: production API base URL fallback — use relative paths on non-localhost browser

NEXT_PUBLIC_API_BASE_URL is not baked into the Stage 1 build (set in
Stage 2 after the frontend is already built), so process.env.NEXT_PUBLIC_API_BASE_URL
is undefined in the client bundle on HuggingFace. The old fallback returned
'http://127.0.0.1:8000' for any non-localhost browser, which is the
client's own loopback — inaccessible from HF — blocking all client-side
API calls including Google OAuth.

Fix: when running in the browser on a non-localhost host, return '' so
fetch uses relative paths (/api/v1/...). nginx then proxies /api/* to
the FastAPI backend. SSR (window === undefined) continues to use the
direct Docker-internal address http://127.0.0.1:8000.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/lib/api.ts

@@ -13,12 +13,14 @@ const getBaseUrl = () => {
     if (process.env.NEXT_PUBLIC_API_URL) return process.env.NEXT_PUBLIC_API_URL;
 
     if (typeof window !== "undefined") {
+        // Browser context: localhost dev hits backend directly; production uses
+        // relative paths so nginx can proxy /api/* to the backend.
         if (window.location.hostname === "localhost") {
             return "http://localhost:8000";
         }
+        return ""; // relative URLs — works in any production deployment (HF, Docker, etc.)
     }
-    // Strict fallback for Next.js internal server-side static generation builds (SSG)
-    // where window is undefined and env vars might be missing.
+    // Server-side (SSR inside Docker): backend is accessible at 127.0.0.1:8000 internally.
     return "http://127.0.0.1:8000";
 };