refactor(api): resolve the backend URL in one place

VITE_BASE_API_URL with a localhost:3001/api fallback was re-derived in six
files across libs/api, libs/auth, the portal and the backoffice — and a seventh
site (UserManagementPage) read the env raw with no fallback at all, handing the
IAM user-management app an undefined apiUrl whenever no .env was present.

BASE_API_URL in base-query-with-reauth.ts is now the single definition,
exported from @ema-platform/api; every other site imports it. Trims the env
value and treats blank as unset, matching how the backend reads its own keys.

apps/backoffice/src/app/features/certificate-designer/config/designer.ts

@@ -1,9 +1,9 @@
 import type { Bilingual, LicenseCategory, LicenseTemplate, LicenseType } from '@ema-platform/api';
 
+import { BASE_API_URL } from '@ema-platform/api';
+
 /** Same resolution — and same fallback — the shared RTK Query baseQuery uses. */
-export const API_BASE_URL =
+export const API_BASE_URL = BASE_API_URL;
-  (import.meta as { env?: Record<string, string> }).env?.['VITE_BASE_API_URL'] ??
-  'http://localhost:3001/api';
 
 export const STATUS_COLOR: Record<LicenseTemplate['status'], string> = {
   DRAFT: 'gray',

apps/backoffice/src/app/features/user-management/UserManagementPage.tsx

@@ -3,6 +3,7 @@ import { useCallback, useEffect, useRef } from 'react';
 import { createRoot, type Root } from 'react-dom/client';
 import { useNavigate } from 'react-router-dom';
 import { UserManagementApp } from '@tria-plc/iamui';
+import { BASE_API_URL } from '@ema-platform/api';
 import type { DesignConfig, UserManagementSessionOptions } from '@tria-plc/iamui';
 import '@tria-plc/iamui/style.css';
 
@@ -99,7 +100,7 @@ const UM_CONFIG: DesignConfig = {
 
 const UM_RUNTIME = {
   basename: '/um',
-  apiUrl: import.meta.env.VITE_BASE_API_URL,
+  apiUrl: BASE_API_URL,
 };
 
 const buttonStyle: React.CSSProperties = {

apps/portal/src/app/features/certificates/pages/CertificatesPage.tsx

@@ -120,9 +120,7 @@ function formatDate(value: string | null | undefined): string {
   });
 }
 
-const API_BASE =
+import { BASE_API_URL as API_BASE } from '@ema-platform/api';
-  (import.meta as { env?: Record<string, string> }).env?.['VITE_BASE_API_URL'] ??
-  'http://localhost:3001/api';
 
 async function generateCertificate(profileId: string): Promise<Blob> {
   const token = authStorage.getToken();

libs/api/src/index.ts

@@ -7,5 +7,5 @@ export * from './lib/features/seafarer';
 export * from './lib/features/seafarer-registration';
 export * from './lib/features/seafarer-document';
 export * from './lib/features/vessel';
-export { baseQueryWithReauth, configureTokenRefresh } from './lib/base-api/base-query-with-reauth';
+export { BASE_API_URL, baseQueryWithReauth, configureTokenRefresh } from './lib/base-api/base-query-with-reauth';
 export { openAuthedDocument, downloadAuthedFile } from './lib/base-api/download';

libs/api/src/lib/base-api/base-query-with-reauth.ts

@@ -2,10 +2,15 @@ import { fetchBaseQuery, type BaseQueryFn } from "@reduxjs/toolkit/query/react";
 import type { FetchArgs, FetchBaseQueryError } from "@reduxjs/toolkit/query";
 import { resolveSessionContext } from "../session";
 
+/**
+ * The one place the backend URL is resolved: VITE_BASE_API_URL from the env,
+ * falling back to the local dev API (3001 — the portal itself owns 3000 for
+ * the Fayda redirect). Import this; do not re-derive it.
+ */
 export const BASE_API_URL =
   (import.meta as { env?: Record<string, string> }).env?.[
     "VITE_BASE_API_URL"
-  ] ?? "http://localhost:3001/api";
+  ]?.trim() || "http://localhost:3001/api";
 
 let _onTokenExpired: (() => Promise<string>) | null = null;
 let _onAuthFailure: (() => void) | null = null;

libs/api/src/lib/features/licensing/licensing.helpers.ts

@@ -10,9 +10,7 @@ import type {
   ValidationIssue,
 } from './licensing.types';
 
-const BASE_API_URL =
+import { BASE_API_URL } from '../../base-api/base-query-with-reauth';
-  (import.meta as { env?: Record<string, string> }).env?.['VITE_BASE_API_URL'] ??
-  'http://localhost:3001/api';
 
 /**
  * Uploads a document straight to the API.

libs/auth/src/lib/components/AuthBootstrap.tsx

@@ -6,9 +6,7 @@ import { hydrateAuth, logout, setToken, setUser } from '../store/auth.slice';
 import { refreshAccessToken } from '../utils/refresh-token';
 import type { AuthUser } from '../types/auth.types';
 
-const BASE_API_URL =
+import { BASE_API_URL } from '@ema-platform/api';
-  (import.meta as { env?: Record<string, string> }).env?.['VITE_BASE_API_URL'] ??
-  'http://localhost:3001/api';
 
 /**
  * Restores the signed-in session before the router renders.

libs/auth/src/lib/utils/refresh-token.ts

@@ -1,9 +1,6 @@
 import { authStorage } from "./auth-storage";
 
-const BASE_API_URL =
+import { BASE_API_URL } from "@ema-platform/api";
-  (import.meta as { env?: Record<string, string> }).env?.[
-    "VITE_BASE_API_URL"
-  ] ?? "http://localhost:3001/api";
 
 interface RefreshResponse {
   token: string;