fix: use full API URL for OAuth login redirects

In Traefik deployment, API and web are on different domains.
Frontend was using relative paths (/auth/login) which resolved
to the web domain instead of the API domain.

- Update LoginRedirectPage to use VITE_API_BASE_URL for login link
- Update apiClient 401 interceptor to redirect to full API URL
- Ensures OAuth flow works correctly with separate domains

apps/web/src/api/client.ts

@@ -19,7 +19,7 @@ apiClient.interceptors.response.use(
   (error) => {
     const status = error?.response?.status;
     if (status === 401 && !shouldSkipAuthRedirect(window.location.pathname)) {
-      window.location.assign("/auth/login");
+      window.location.assign(`${BASE_URL}/auth/login`);
     }
     return Promise.reject(error);
   }

apps/web/src/pages/placeholder.tsx

@@ -16,6 +16,8 @@ export const NotFoundPage = () => {
   );
 };
 
+const API_BASE_URL = import.meta.env.VITE_API_BASE_URL ?? "http://localhost:8000";
+
 export const LoginRedirectPage = () => {
   const nextPath = new URLSearchParams(window.location.search).get("next") ?? "/";
   const encodedNext = encodeURIComponent(nextPath);
@@ -24,7 +26,7 @@ export const LoginRedirectPage = () => {
     <section className="stack center-screen">
       <h1>Sign in required</h1>
       <p className="muted">You need to authenticate to access this section.</p>
-      <a className="primary-button" href={`/auth/login?next=${encodedNext}`}>
+      <a className="primary-button" href={`${API_BASE_URL}/auth/login?next=${encodedNext}`}>
         Continue to login
       </a>
     </section>