fix: guard VITE_BACKEND_URL fallback to prevent module-load crash

[birme]

Summary

• src/api/api.ts called .replace() directly on import.meta.env.VITE_BACKEND_URL; when that env var is undefined at build time this threw a TypeError during module evaluation, crashing the whole app at load.
• The intended || window.location.origin fallback never ran because the crash happened inside the template-literal evaluation before || was reached.
• Moved the fallback inside the expression using ?? so window.location.origin is used before .replace() is called: ${(import.meta.env.VITE_BACKEND_URL ?? window.location.origin).replace(/\/+$/, "")}/${API_VERSION}.
• Added a focused Vitest regression test that stubs VITE_BACKEND_URL as undefined and asserts the module loads without throwing (fails on old code with the exact TypeError, passes on the fix).

Test plan

• Tests pass (npm test) — 18 files, 147 tests
• TypeScript compiles (npm run typecheck)
• Lint clean (npm run lint)
• Frontend loads and falls back to window.location.origin when VITE_BACKEND_URL is unset

Closes #646

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

[birme]

Code Review

Verdict: LGTM

Summary: A small, correct fix for a real module-load crash (#646). The root cause — calling .replace() on a possibly-undefined import.meta.env.VITE_BACKEND_URL before the || fallback could short-circuit — is properly addressed by moving the fallback inside the expression with ??. A focused regression test is included and CI is fully green.

---

Blocking

None.

---

Warnings

None.

---

Suggestions

• src/api/api.ts:4-6 — The fix is correct: (import.meta.env.VITE_BACKEND_URL ?? window.location.origin).replace(/\/+$/, "") now resolves the fallback before .replace() runs, which is exactly why the old ... || window.location.origin form failed (the TypeError was thrown inside the template literal before || was evaluated). Consider a brief inline comment noting why ?? must wrap the value pre-.replace(), to prevent a future refactor from reintroducing the crash. Optional.
• src/api/api.test.ts:17 — vi.stubEnv("VITE_BACKEND_URL", undefined) correctly reproduces the unset-at-build-time path and would fail against the old code with the original TypeError, so the regression test genuinely guards the fixed behavior. As an optional strengthening, you could also assert on the resolved API URL shape (e.g., that it starts with window.location.origin and ends with the API version) rather than only that the import resolves — this would catch a regression where the module loads but resolves to a wrong/undefined-prefixed URL.
• src/api/api.test.ts — Test uses the default happy-dom environment (no @vitest-environment jsdom override), touches no RTCPeerConnection/srcObject, and uses no setTimeout-based waits — all consistent with project test rules. No action needed.

---

Domain Note

Not applicable — this change is confined to base-URL resolution and does not touch audio routing, PTT, dominant speaker, data channel parsing, or WHIP/WHEP session lifecycle.