fix(frontend): resolve production API URL fallback to localhost

Problem:
The unified Docker image builds the frontend at build time without
VITE_API_URL. Vite inlined import.meta.env.VITE_API_URL as undefined,
so every API call fell back to the hardcoded 'http://localhost:8080'.
This broke Casa deployments where the frontend loaded from the public
 domain but tried to reach the backend at localhost.

Solution:
1. Centralize API URL resolution in lib/api-url.ts via getApiOrigin().
   It checks runtime window.ENV first (injected by docker-entrypoint.sh
   at container startup), then build-time import.meta.env, then dev
   fallback. In production unified deployments it returns '' so API
   calls use same-origin relative URLs (/api/v1/...) that nginx proxies
   to the backend.
2. Replace all 50+ inline import.meta.env.VITE_API_URL || 'localhost'
   usages across 14 source files with getApiOrigin() / getApiV1BaseUrl().
3. Add build args and runtime sed substitution to Dockerfile and
   docker-entrypoint.sh so the same image works for any deployment.
4. Pass VITE_API_URL through docker-compose.yml and CI/CD build-args.

Verified:
- Production bundle contains 0 occurrences of localhost:8080.
- Container health check and /api/v1/auth/check-users both return 200.
- Runtime injection correctly sets VITE_API_URL='' for same-origin
  and VITE_API_URL='https://domain' for external backend.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docker-compose.yml

@@ -13,6 +13,10 @@ services:
       JWT_SECRET: ${JWT_SECRET:-}
       GIN_MODE: release
       CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-*}
+      # VITE_API_URL defaults to empty for same-origin relative URLs.
+      # Set explicitly only when frontend and backend are on different origins.
+      VITE_API_URL: ${VITE_API_URL:-}
+      VITE_DEMO_MODE: ${VITE_DEMO_MODE:-false}
     volumes:
       - trackeep_postgres:/var/lib/postgresql/data
       - trackeep_uploads:/app/uploads