security: validate api client base URLs

[es3298]

Summary

• validate NEXT_PUBLIC_STABLEROUTE_API_BASE once with new URL(...) and allow only http/https schemes
• resolve API request paths through a guarded helper so absolute, protocol-relative, and backslash origin-escape paths are rejected before fetch
• keep valid localhost/http(s) behavior compatible and avoid exposing raw misconfigured base values in thrown messages
• document the API base/path constraints in the README

Closes #144

Threat model

A misconfigured public API base or a caller-provided absolute path could redirect frontend requests away from the configured StableRoute API origin. This patch fails closed before fetch for invalid base schemes, malformed base URLs, absolute/protocol-relative paths, and URL parser edge cases that would resolve to another origin. Error messages are intentionally generic so raw config values are not leaked.

Validation

• npm test -- src/lib/__tests__/apiClient.test.ts --runInBand
• npm test -- src/lib/__tests__/apiClient.test.ts --runInBand --coverage --collectCoverageFrom=src/lib/apiClient.ts
  • apiClient.ts: 96% statements, 100% branches, 100% lines
• npm run lint
• git diff --check

Notes

• npm run build is still blocked by the existing upstream src/app/quote/Client.tsx assetsDiffer type error.
• npm test -- --runInBand is still blocked by existing upstream assetsDiffer quote test failures and the existing theme storage no-op expectation failure.