fix(api): remove NEXT_PUBLIC_API_URL to prevent localhost fallback in client bundle (#88)

Turbopack was not dead-code-eliminating the typeof window ternary
correctly, causing the server-side fallback (http://localhost:3000)
to leak into the client bundle. The browser then made cross-origin
requests to localhost instead of same-origin relative URLs, producing
"NetworkError when attempting to fetch resource" on staging.

Replace the fragile process.env pattern with a simple literal: client
always uses '' (relative URLs via Caddy), server uses API_INTERNAL_URL.

src/lib/api/auth-fetch.ts

···
 import { refreshSession } from './client'
 import type { AuthSession } from './types'
 
+/** Client: relative URLs (empty string). Server: internal Docker network URL. */
 const API_URL =
-  typeof window !== 'undefined'
-    ? (process.env.NEXT_PUBLIC_API_URL ?? '')
-    : (process.env.API_INTERNAL_URL ?? 'http://localhost:3000')
+  typeof window === 'undefined' ? (process.env.API_INTERNAL_URL ?? 'http://localhost:3000') : ''
 
 interface AuthFetchOptions {
   method?: 'GET' | 'POST' | 'PUT' | 'DELETE'

src/lib/api/client.ts

···
   BehavioralFlag,
 } from './types'
 
+/** Client: relative URLs (empty string). Server: internal Docker network URL. */
 const API_URL =
-  typeof window !== 'undefined'
-    ? (process.env.NEXT_PUBLIC_API_URL ?? '')
-    : (process.env.API_INTERNAL_URL ?? 'http://localhost:3000')
+  typeof window === 'undefined' ? (process.env.API_INTERNAL_URL ?? 'http://localhost:3000') : ''
 
 interface FetchOptions {
   headers?: Record<string, string>