feat: make API_BASE configurable (remove hardcoded URL)

[Ragnar-no-sleep]

Context

API_BASE is currently hardcoded in public/index.html:

const API_BASE = 'https://lock-verifier.onrender.com';

Problem

• Breaks local development (localhost vs production)
• Requires code change for any environment (staging, fork, etc.)
• Harder to fork/reuse for other token projects

Proposed fix

Option A — env-injected config endpoint (recommended)

// Fetch config from server (already exists: GET /api/config)
const { apiBase } = await fetch('/api/config').then(r => r.json());

Extend /api/config to return apiBase, sourced from API_BASE env var.

Option B — relative URL

// Use relative URL — works for any deployment
const API_BASE = '';  // empty = same origin

Since the frontend is served by the same Express server, relative URLs (/api/locks) already work without specifying a host.

Why now

ASDF-Web frontend shell (staking.html) needs to call this API. Relative URLs allow the ASDF-Web Express server to proxy requests cleanly without hardcoding the backend URL in the frontend.

Effort

XS — 1 line change (Option B) or ~10 lines (Option A)

---

From ASDF-Web × TokenVotingUtil integration audit — 2026-02-25