Ask where the backend lives on first start (runtime setup)

Replaces the build-time VITE_API_BASE knob with a runtime setup screen so
one build works same-origin and cross-origin:

- frontend/src/lib/backend.ts stores the API origin in localStorage
  (empty = same origin). DEFAULT_BACKEND_URL is the clearly marked,
  easily edited prefilled default — the matrix.org equivalent; set it to
  your public API origin.
- Production builds show /setup before anything else on first start,
  with a connection test against /health (or leave it blank for this
  server). The route stays reachable from Account -> Backend connection;
  switching backends clears the previous backend's token and reloads.
- Input normalisation: scheme defaulted (https, http for localhost),
  trailing slashes trimmed; a failed cross-origin test points at
  CORS_ALLOWED_ORIGINS.
- Dev keeps defaulting to the same-origin Vite proxy; /setup can be
  visited manually.

Verified: normalisation cases in Node, /health returns CORS headers for
an allowed origin, tsc/oxlint/build clean.

frontend/src/lib/api.ts

@@ -1,18 +1,12 @@
 import type { TempUpload } from "@/lib/types";
+import { getBackendUrl } from "@/lib/backend";
 
 const TOKEN_KEY = "j621.token";
 
-/**
- * Backend origin when the SPA is served from somewhere else (build-time
- * `VITE_API_BASE`, e.g. `https://j621-api.example.com`). Empty means
- * same-origin, which is the default and needs no configuration.
- */
-const API_BASE = String(import.meta.env.VITE_API_BASE ?? "").replace(/\/+$/, "");
-
 /** Absolutise a backend path; external/absolute URLs pass through. */
 export function apiUrl(path: string): string {
   if (!path.startsWith("/")) return path;
-  return `${API_BASE}${path}`;
+  return `${getBackendUrl()}${path}`;
 }
 
 export function getToken(): string | null {

frontend/src/lib/backend.ts

@@ -0,0 +1,48 @@
+/**
+ * Where the J621 API lives.
+ *
+ * A production build asks for this on first start (`/setup`) and remembers the
+ * answer per browser, so one build works same-origin AND against a backend on
+ * another domain. Same-origin is the empty string.
+ *
+ * Self-hosters: set DEFAULT_BACKEND_URL to the origin where your API is
+ * reachable to prefill the setup screen — the equivalent of the matrix.org
+ * default in Matrix clients. Leave it empty to default to "this server".
+ */
+export const DEFAULT_BACKEND_URL = "";
+
+const STORAGE_KEY = "j621.backend";
+
+/** Trim slashes, add a scheme when missing (http for localhost, else https). */
+export function normalizeBackendUrl(value: string): string {
+  const trimmed = value.trim().replace(/\/+$/, "");
+  if (!trimmed) return "";
+  if (/^https?:\/\//i.test(trimmed)) return trimmed;
+  const local = /^(localhost|127\.0\.0\.1|\[::1\])(?::|\/|$)/i.test(trimmed);
+  return `${local ? "http" : "https"}://${trimmed}`;
+}
+
+/** null = the user never chose; "" = same-origin. */
+export function getStoredBackendUrl(): string | null {
+  const raw = window.localStorage.getItem(STORAGE_KEY);
+  return raw === null ? null : normalizeBackendUrl(raw);
+}
+
+/** Current API origin; empty string means same-origin. */
+export function getBackendUrl(): string {
+  return getStoredBackendUrl() ?? DEFAULT_BACKEND_URL;
+}
+
+export function setBackendUrl(value: string): void {
+  window.localStorage.setItem(STORAGE_KEY, normalizeBackendUrl(value));
+}
+
+/**
+ * Production builds must be told where the API is on first start; the dev
+ * server keeps defaulting to the same-origin Vite proxy (visit /setup to
+ * change it manually).
+ */
+export function needsBackendSetup(): boolean {
+  if (getStoredBackendUrl() !== null) return false;
+  return import.meta.env.PROD;
+}