fix(frontend): prefix auth API requests with VITE_PUBLIC_APP_URL for cross-origin Workers hosting

frontend/src/main.ts

@@ -428,7 +428,8 @@ async function submitAuth(path: string) {
     return;
   }
   try {
-    const res = await fetch(path, {
+    const apiUrl = import.meta.env.VITE_PUBLIC_APP_URL?.trim() || window.location.origin;
+    const res = await fetch(`${apiUrl}${path}`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ username: u, password: p }),