fix: restore /api prefix in frontend baseURL, strip from API_URL fallback

The previous 'double /api' fix (d5adc2f) was wrong. Production sets
NEXT_PUBLIC_API_URL without /api, so the old `${API_URL}/api` was
load-bearing. The real fix: remove /api from the fallback values
(both browser and dev branches), keep /api only in the baseURL literal.

Before: API_URL fallback included /api → double /api when env var absent
After:  API_URL is origin only → baseURL = `${origin}/api` always correct

frontend/src/lib/api.ts

@@ -3,11 +3,11 @@ import axios from "axios";
 const API_URL =
 	process.env.NEXT_PUBLIC_API_URL ||
 	(typeof window !== "undefined"
-		? `${window.location.origin}/api`
-		: "http://localhost:3001/api");
+		? window.location.origin
+		: "http://localhost:3001");
 
 export const api = axios.create({
-	baseURL: API_URL,
+	baseURL: `${API_URL}/api`,
 	headers: {
 		"Content-Type": "application/json",
 	},