fix(desktop): restore VITE_API_BASE for the desktop build

apps/web/.env.production's VITE_API_BASE went empty in 96fd97e to fix the
booth/browser same-origin case, but the desktop build shares that file and
was never given its own override — login broke with WebKitGTK's "The
string did not match the expected pattern." (a relative fetch() URL with
no base, from tauri://localhost). beforeBuildCommand now sets
VITE_API_BASE=http://127.0.0.1:3000 inline for the desktop build only;
verified both builds independently produce the right output.

wiki/decisions/desktop-shell-tauri.md

@@ -140,10 +140,21 @@ Per the user's choices — the operator **keeps OS access** (no fullscreen lockd
 - **Right-click:** the context menu is blocked in **prod only** (`apps/web/src/lib/kiosk.ts`,
   guarded on `import.meta.env.PROD`); dev keeps right-click + devtools. Applies to both the browser
   prod build and the desktop build (same SPA).
-- **`VITE_API_BASE` wired to the environment:** `apps/web/.env.production` (committed, non-secret,
-  allow-listed in `.gitignore`) sets `VITE_API_BASE=http://127.0.0.1:3000`, auto-loaded by
-  `vite build` (which the desktop bundle runs). So the desktop build targets Fastify with no manual
-  export; the browser-served-by-Fastify build should override to `""`.
+- **`VITE_API_BASE` — desktop vs. browser (regression found + fixed 2026-09-03):**
+  `apps/web/.env.production` (committed, shared by both builds) sets `VITE_API_BASE=` (empty) — this
+  is correct for the **browser/booth** build (Fastify same-origin, stays relative) since commit
+  `96fd97e` (2026-06-27), but that same change silently broke the **desktop** build, which was never
+  given its own override. Result: the desktop shell's `apiUrl()` returned a bare relative path
+  (`/api/auth/login`) to `fetch()` from a page loaded at `tauri://localhost` — WebKitGTK has no base
+  to resolve a relative URL against from a non-`http(s)` origin, and threw `DOMException: "The
+  string did not match the expected pattern."` on the first authenticated request (login). Login
+  worked fine in the browser (same-origin, no absolute URL needed) the whole time, which is what
+  made this easy to miss. **Fix:** `tauri.conf.json`'s `build.beforeBuildCommand` now sets
+  `VITE_API_BASE=http://127.0.0.1:3000` inline (`VITE_API_BASE=http://127.0.0.1:3000 pnpm --filter
+  @parking/web build`) — process env vars override `.env.production` in Vite's load order, so this
+  overrides the shared file for the desktop build only, without touching it (the browser/booth build
+  still gets the empty value, unaffected). Verified: rebuilding with the override bakes
+  `127.0.0.1:3000` into the bundle; rebuilding without it stays clean/relative.
 - **Auto-update (prompt-on-update, self-hosted):** `tauri-plugin-updater` + `tauri-plugin-process`.
   On launch the SPA checks the endpoint (`apps/web/src/lib/desktop-updater.ts`, no-op in browser /
   offline), prompts the operator (i18n `update.prompt`), then `downloadAndInstall()` + `relaunch()`.