fix(desktop): normalize API base URL across renderer and main

Replace ad-hoc trim/fallback logic with a shared normalizer that strips
trailing slashes and accidental /api suffixes, rejects non-http schemes,
and rewrites Vite dev origins (517x) back to localhost:8080 so the
desktop client never points its API client at the renderer dev server.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/transport/api-client.ts

@@ -35,6 +35,7 @@ import {
   startObservedRequest,
 } from '../network-observer'
 import { canUseRendererDevtoolsProxy, rendererDevtoolsFetch } from '../renderer-devtools-proxy'
+import { normalizeDesktopApiBaseURL } from '../../shared/api-base-url'
 
 type TransportAuthState = 'pending' | 'registered' | 'expired'
 type TransportDispatchState = 'idle' | 'connecting' | 'streaming'
@@ -64,7 +65,7 @@ interface MonitoringCancelTaskResponse {
 
 let desktopApiClient: ApiClient | null = null
 let transportSession: DesktopTransportSession = {
-  baseURL: process.env.DESKTOP_API_BASE_URL ?? 'http://localhost:8080',
+  baseURL: normalizeDesktopApiBaseURL(process.env.DESKTOP_API_BASE_URL),
   clientToken: null,
 }
 const ACCOUNT_UPSERT_CACHE_TTL_MS = 5 * 60_000
@@ -364,7 +365,7 @@ export function configureTransport(
 ): ApiClient | null {
   if (!session) {
     transportSession = {
-      baseURL: process.env.DESKTOP_API_BASE_URL ?? 'http://localhost:8080',
+      baseURL: normalizeDesktopApiBaseURL(process.env.DESKTOP_API_BASE_URL),
       clientToken: null,
     }
     transportState.baseURL = transportSession.baseURL
@@ -377,7 +378,7 @@ export function configureTransport(
   }
 
   transportSession = {
-    baseURL: session.api_base_url.trim() || 'http://localhost:8080',
+    baseURL: normalizeDesktopApiBaseURL(session.api_base_url),
     clientToken: session.client_token,
   }
   transportState.baseURL = transportSession.baseURL