fix(desktop): restore VITE_API_BASE for the desktop build

apps/web/.env.production's VITE_API_BASE went empty in 96fd97e to fix the
booth/browser same-origin case, but the desktop build shares that file and
was never given its own override — login broke with WebKitGTK's "The
string did not match the expected pattern." (a relative fetch() URL with
no base, from tauri://localhost). beforeBuildCommand now sets
VITE_API_BASE=http://127.0.0.1:3000 inline for the desktop build only;
verified both builds independently produce the right output.

wiki/log.md

@@ -2740,3 +2740,17 @@ model (booth operator as primary adversary) makes an extractable, hard-to-rotate
 deployed binary worse than just publishing installers publicly. `release.yml`,
 `apps/desktop/src-tauri/tauri.conf.json`, `apps/desktop/README.md` updated; full detail on
 [[desktop-shell-tauri]].
+
+## [2026-09-03] fix | Desktop login broken by a VITE_API_BASE regression from the booth same-origin fix
+
+The 2026-06-27 booth fix (commit 96fd97e) correctly blanked `apps/web/.env.production`'s
+`VITE_API_BASE` for the browser/booth same-origin case, but the desktop build shares that same
+file and was never given its own override — the desktop shell has been building with an empty
+API base since that commit, unnoticed until now. Symptom: login threw `DOMException: "The string
+did not match the expected pattern."` — WebKitGTK rejecting a relative `fetch()` URL with no base
+to resolve against, since the desktop window's origin is `tauri://localhost`. Browser login was
+unaffected (same-origin, no absolute URL needed), which is why this went unnoticed through the CI
+mirror-repo debugging session. Fixed by setting `VITE_API_BASE=http://127.0.0.1:3000` inline in
+`tauri.conf.json`'s `beforeBuildCommand`, overriding the shared `.env.production` for the desktop
+build only (process env wins in Vite's load order) — verified both builds independently. Full
+detail on [[desktop-shell-tauri]].