fix(frontend): drop localStorage HF_BACKEND_BASE_URL; env-only

api.ts + useAuthConfig kept the old wizard-era localStorage path for the
backend URL, which is why fresh browsers saw blank pages on MonitorPage
and any other api-using page after the v0.4.0 wizard removal — without
the wizard pre-seeding localStorage, getApiBase() returned undefined and
axios called same-origin (frontend nginx, 404).

App.tsx getApiBase() partially worked because I had only refactored that
one path; api.ts (used by everything else) still had its own duplicate
getApiBase that I missed.

This commit removes the localStorage path entirely from all 3 read sites
(api.ts / App.tsx / useAuthConfig.ts) — single source of truth is now
the build-time env baked in by the Dockerfile ARG.

- src/services/api.ts:    const API_BASE = import.meta.env.VITE_HF_BACKEND_BASE_URL
- src/App.tsx:            const API_BASE = ... (replaces getApiBase())
- src/hooks/useAuthConfig.ts: const BACKEND_BASE = ...
- src/test/setup.ts: stub import.meta.env instead of localStorage key

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/hooks/useAuthConfig.ts

@@ -45,14 +45,14 @@ async function load(): Promise<AuthConfig> {
 }
 
 /** Absolute backend URL for full-page OIDC redirects. */
+const BACKEND_BASE = import.meta.env.VITE_HF_BACKEND_BASE_URL || ''
+
 export function oidcLoginHref(cfg: AuthConfig): string {
-  const base = localStorage.getItem('HF_BACKEND_BASE_URL') ?? ''
-  return `${base}${cfg.oidcLoginUrl}`
+  return `${BACKEND_BASE}${cfg.oidcLoginUrl}`
 }
 
 export function oidcLinkHref(): string {
-  const base = localStorage.getItem('HF_BACKEND_BASE_URL') ?? ''
-  return `${base}/auth/oidc/link`
+  return `${BACKEND_BASE}/auth/oidc/link`
 }
 
 export function useAuthConfig() {