Ask where the backend lives on first start (runtime setup)

Replaces the build-time VITE_API_BASE knob with a runtime setup screen so
one build works same-origin and cross-origin:

- frontend/src/lib/backend.ts stores the API origin in localStorage
  (empty = same origin). DEFAULT_BACKEND_URL is the clearly marked,
  easily edited prefilled default — the matrix.org equivalent; set it to
  your public API origin.
- Production builds show /setup before anything else on first start,
  with a connection test against /health (or leave it blank for this
  server). The route stays reachable from Account -> Backend connection;
  switching backends clears the previous backend's token and reloads.
- Input normalisation: scheme defaulted (https, http for localhost),
  trailing slashes trimmed; a failed cross-origin test points at
  CORS_ALLOWED_ORIGINS.
- Dev keeps defaulting to the same-origin Vite proxy; /setup can be
  visited manually.

Verified: normalisation cases in Node, /health returns CORS headers for
an allowed origin, tsc/oxlint/build clean.

frontend/src/lib/api.ts

@@ -1,18 +1,12 @@
 import type { TempUpload } from "@/lib/types";
+import { getBackendUrl } from "@/lib/backend";
 
 const TOKEN_KEY = "j621.token";
 
-/**
- * Backend origin when the SPA is served from somewhere else (build-time
- * `VITE_API_BASE`, e.g. `https://j621-api.example.com`). Empty means
- * same-origin, which is the default and needs no configuration.
- */
-const API_BASE = String(import.meta.env.VITE_API_BASE ?? "").replace(/\/+$/, "");
-
 /** Absolutise a backend path; external/absolute URLs pass through. */
 export function apiUrl(path: string): string {
   if (!path.startsWith("/")) return path;
-  return `${API_BASE}${path}`;
+  return `${getBackendUrl()}${path}`;
 }
 
 export function getToken(): string | null {