[feat] Configurable API base and desktop-ready transport

[St4NNi]

Goal

The portal must run unchanged inside a desktop webview and against externally hosted nodes. Today parts of the SPA assume same-origin serving. Make the API base URL and the transport layer injectable so the same build serves node-hosted, externally hosted, and desktop-shell deployments.

Workplan

1. Audit every fetch/EventSource/upload path for same-origin and absolute-path assumptions
2. Introduce one injected API base + transport wrapper used by all composables
3. Make the auth flow (OIDC redirect, token storage) work from a non-served origin and a webview
4. Document the injection contract for the desktop shell

Definition of Done

• Portal runs from a foreign origin against a remote node with all e2e flows green
• No module reads window.location to construct API URLs directly
• Auth round-trip works in a webview context

Test Concept

E2e suite runs once served from the node and once from a dev server pointing at a remote API.

Risks

Hidden same-origin assumptions in third-party components surface late.

[St4NNi]

Status: partial on feat/portal-next (pending). The API base is injectable (VITE_ARUNA_API_BASE_URL, runtime /portal-config.json, per-user override) and all calls go through a timeout-bounded fetch wrapper with session-epoch guards; notifications use fetch streaming rather than EventSource. Still open: URL construction still resolves against window.location.origin, the OIDC redirect_uri is derived from the served origin so webview/foreign-origin auth is unproven, and the foreign-origin e2e run.