fix(tauri): add absolute API base URL default and CORS origins for Android WebView

- Set VITE_API_BASE_URL default to production API URL in api-client.ts
  so fetch() uses absolute URLs instead of relative paths that fail on Tauri
- Add tauri://localhost and https://tauri.localhost to API CORS allowed origins
- Also fix .env WEB_APP_URL from stale .tech to .my.id

Co-Authored-By: Claude <noreply@anthropic.com>

apps/api/src/config/env.ts

@@ -8,6 +8,12 @@ const googleOAuthEnabled = Boolean(
 );
 
 const webAppUrl = Bun.env.WEB_APP_URL ?? 'http://localhost:5173';
+const allowedOrigins = [
+  webAppUrl,
+  'https://tauri.localhost',
+  'tauri://localhost',
+  'http://localhost:5173',
+];
 const secureCookies = Bun.env.SECURE_COOKIES === 'true' || webAppUrl.startsWith('https://');
 
 export const env = {
@@ -24,6 +30,7 @@ export const env = {
   googleClientSecret: Bun.env.GOOGLE_CLIENT_SECRET,
   googleRedirectUri: Bun.env.GOOGLE_REDIRECT_URI,
   webAppUrl,
+  allowedOrigins,
   secureCookies,
 };
 

apps/api/src/index.ts

@@ -17,7 +17,7 @@ assertRequiredEnv();
 
 const app = new Elysia()
   .use(cors({
-    origin: env.webAppUrl,
+    origin: env.allowedOrigins,
     credentials: true,
   }))
   .use(metricsRoutes)

apps/web/src/lib/api-client.ts

@@ -14,7 +14,7 @@ import type {
 } from '@zeavis/shared';
 import { recordApiCall } from './telemetry';
 
-const apiBaseUrl = import.meta.env.VITE_API_BASE_URL ?? '';
+const apiBaseUrl = import.meta.env.VITE_API_BASE_URL ?? 'https://zeavisedu.asepharyana.my.id';
 
 export interface ApiError extends Error {
   status: number;