Support secure same-origin API URLs

frontend/src/lib/api.ts

@@ -1,5 +1,28 @@
-export const API_BASE_URL = import.meta.env.VITE_API_BASE_URL ?? "http://localhost:8000";
-export const WS_URL = import.meta.env.VITE_WS_URL ?? "ws://localhost:8000/ws/dashboard";
+function resolveApiBaseUrl() {
+  const configuredUrl = import.meta.env.VITE_API_BASE_URL;
+  if (configuredUrl) {
+    return configuredUrl;
+  }
+  if (typeof window === "undefined") {
+    return "http://localhost:8000";
+  }
+  return window.location.origin;
+}
+
+function resolveWsUrl() {
+  const configuredUrl = import.meta.env.VITE_WS_URL;
+  if (configuredUrl) {
+    return configuredUrl;
+  }
+  if (typeof window === "undefined") {
+    return "ws://localhost:8000/ws/dashboard";
+  }
+  const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
+  return `${protocol}//${window.location.host}/ws/dashboard`;
+}
+
+export const API_BASE_URL = resolveApiBaseUrl();
+export const WS_URL = resolveWsUrl();
 
 export async function fetchJson<T>(path: string, init?: RequestInit): Promise<T> {
   const response = await fetch(`${API_BASE_URL}${path}`, {