refactor(api): resolve the backend URL in one place

VITE_BASE_API_URL with a localhost:3001/api fallback was re-derived in six
files across libs/api, libs/auth, the portal and the backoffice — and a seventh
site (UserManagementPage) read the env raw with no fallback at all, handing the
IAM user-management app an undefined apiUrl whenever no .env was present.

BASE_API_URL in base-query-with-reauth.ts is now the single definition,
exported from @ema-platform/api; every other site imports it. Trims the env
value and treats blank as unset, matching how the backend reads its own keys.

libs/auth/src/lib/components/AuthBootstrap.tsx

@@ -6,9 +6,7 @@ import { hydrateAuth, logout, setToken, setUser } from '../store/auth.slice';
 import { refreshAccessToken } from '../utils/refresh-token';
 import type { AuthUser } from '../types/auth.types';
 
-const BASE_API_URL =
-  (import.meta as { env?: Record<string, string> }).env?.['VITE_BASE_API_URL'] ??
-  'http://localhost:3001/api';
+import { BASE_API_URL } from '@ema-platform/api';
 
 /**
  * Restores the signed-in session before the router renders.

libs/auth/src/lib/utils/refresh-token.ts

@@ -1,9 +1,6 @@
 import { authStorage } from "./auth-storage";
 
-const BASE_API_URL =
-  (import.meta as { env?: Record<string, string> }).env?.[
-    "VITE_BASE_API_URL"
-  ] ?? "http://localhost:3001/api";
+import { BASE_API_URL } from "@ema-platform/api";
 
 interface RefreshResponse {
   token: string;