[feat] Configurable API base and desktop-ready transport

[St4NNi]

Goal

The portal must run unchanged inside a desktop webview and against externally hosted nodes. Today parts of the SPA assume same-origin serving. Make the API base URL and the transport layer injectable so the same build serves node-hosted, externally hosted, and desktop-shell deployments.

Workplan

1. Audit every fetch/EventSource/upload path for same-origin and absolute-path assumptions
2. Introduce one injected API base + transport wrapper used by all composables
3. Make the auth flow (OIDC redirect, token storage) work from a non-served origin and a webview
4. Document the injection contract for the desktop shell

Definition of Done

• Portal runs from a foreign origin against a remote node with all e2e flows green
• No module reads window.location to construct API URLs directly
• Auth round-trip works in a webview context

Test Concept

E2e suite runs once served from the node and once from a dev server pointing at a remote API.

Risks

Hidden same-origin assumptions in third-party components surface late.