Development address in shipped code

AI tools like to write the backend address as a fallback into the code: `import.meta.env.VITE_API_URL || "http://localhost:3000"`. As long as the variable is missing at build time, that fallback ends up in the shipped bundle — and the app calls the developer's own machine for every user.

For your users the call goes nowhere: an empty form, a spinner that never ends. If a tunnel (ngrok, localhost.run) is still running there, the call lands on a machine nobody operates or secures.

Verify: open the bundle in the browser and search for `localhost`, `127.0.0.1` or `ngrok`. Fix: read the address only from the environment variable, remove the fallback, rebuild with the variable set.