fix(desktop): normalize API base URL across renderer and main

Replace ad-hoc trim/fallback logic with a shared normalizer that strips
trailing slashes and accidental /api suffixes, rejects non-http schemes,
and rewrites Vite dev origins (517x) back to localhost:8080 so the
desktop client never points its API client at the renderer dev server.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/runtime-controller.ts

@@ -22,6 +22,7 @@ import {
   normalizeAccountPlatformUid,
   sameAccountPlatformUid,
 } from '../shared/account-identity'
+import { normalizeDesktopApiBaseURL } from '../shared/api-base-url'
 import { type PublishAccountIdentity, type PublishAccountProfile } from './account-binder'
 import {
   ensureAccountReady,
@@ -3267,7 +3268,7 @@ function normalizeSession(
   }
 
   return {
-    api_base_url: session.api_base_url.trim() || 'http://localhost:8080',
+    api_base_url: normalizeDesktopApiBaseURL(session.api_base_url),
     mode: session.mode,
     client_token: session.client_token?.trim() || null,
     desktop_client: session.desktop_client ? { ...session.desktop_client } : null,