3377b1e751
The previous 'double /api' fix (d5adc2f) was wrong. Production sets
NEXT_PUBLIC_API_URL without /api, so the old `${API_URL}/api` was
load-bearing. The real fix: remove /api from the fallback values
(both browser and dev branches), keep /api only in the baseURL literal.
Before: API_URL fallback included /api → double /api when env var absent
After: API_URL is origin only → baseURL = `${origin}/api` always correct