fix(desktop): restore VITE_API_BASE for the desktop build

apps/web/.env.production's VITE_API_BASE went empty in 96fd97e to fix the
booth/browser same-origin case, but the desktop build shares that file and
was never given its own override — login broke with WebKitGTK's "The
string did not match the expected pattern." (a relative fetch() URL with
no base, from tauri://localhost). beforeBuildCommand now sets
VITE_API_BASE=http://127.0.0.1:3000 inline for the desktop build only;
verified both builds independently produce the right output.

apps/desktop/src-tauri/tauri.conf.json

@@ -7,7 +7,7 @@
     "devUrl": "http://localhost:5173",
     "frontendDist": "../../web/dist",
     "beforeDevCommand": "pnpm --filter @parking/web dev",
-    "beforeBuildCommand": "pnpm --filter @parking/web build"
+    "beforeBuildCommand": "VITE_API_BASE=http://127.0.0.1:3000 pnpm --filter @parking/web build"
   },
   "app": {
     "windows": [

wiki/decisions/desktop-shell-tauri.md

@@ -140,10 +140,21 @@ Per the user's choices — the operator **keeps OS access** (no fullscreen lockd
 - **Right-click:** the context menu is blocked in **prod only** (`apps/web/src/lib/kiosk.ts`,
   guarded on `import.meta.env.PROD`); dev keeps right-click + devtools. Applies to both the browser
   prod build and the desktop build (same SPA).
-- **`VITE_API_BASE` wired to the environment:** `apps/web/.env.production` (committed, non-secret,
+- **`VITE_API_BASE` — desktop vs. browser (regression found + fixed 2026-09-03):**
-  allow-listed in `.gitignore`) sets `VITE_API_BASE=http://127.0.0.1:3000`, auto-loaded by
+  `apps/web/.env.production` (committed, shared by both builds) sets `VITE_API_BASE=` (empty) — this
-  `vite build` (which the desktop bundle runs). So the desktop build targets Fastify with no manual
+  is correct for the **browser/booth** build (Fastify same-origin, stays relative) since commit
-  export; the browser-served-by-Fastify build should override to `""`.
+  `96fd97e` (2026-06-27), but that same change silently broke the **desktop** build, which was never
+  given its own override. Result: the desktop shell's `apiUrl()` returned a bare relative path
+  (`/api/auth/login`) to `fetch()` from a page loaded at `tauri://localhost` — WebKitGTK has no base
+  to resolve a relative URL against from a non-`http(s)` origin, and threw `DOMException: "The
+  string did not match the expected pattern."` on the first authenticated request (login). Login
+  worked fine in the browser (same-origin, no absolute URL needed) the whole time, which is what
+  made this easy to miss. **Fix:** `tauri.conf.json`'s `build.beforeBuildCommand` now sets
+  `VITE_API_BASE=http://127.0.0.1:3000` inline (`VITE_API_BASE=http://127.0.0.1:3000 pnpm --filter
+  @parking/web build`) — process env vars override `.env.production` in Vite's load order, so this
+  overrides the shared file for the desktop build only, without touching it (the browser/booth build
+  still gets the empty value, unaffected). Verified: rebuilding with the override bakes
+  `127.0.0.1:3000` into the bundle; rebuilding without it stays clean/relative.
 - **Auto-update (prompt-on-update, self-hosted):** `tauri-plugin-updater` + `tauri-plugin-process`.
   On launch the SPA checks the endpoint (`apps/web/src/lib/desktop-updater.ts`, no-op in browser /
   offline), prompts the operator (i18n `update.prompt`), then `downloadAndInstall()` + `relaunch()`.

wiki/log.md

@@ -2740,3 +2740,17 @@ model (booth operator as primary adversary) makes an extractable, hard-to-rotate
 deployed binary worse than just publishing installers publicly. `release.yml`,
 `apps/desktop/src-tauri/tauri.conf.json`, `apps/desktop/README.md` updated; full detail on
 [[desktop-shell-tauri]].
+
+## [2026-09-03] fix | Desktop login broken by a VITE_API_BASE regression from the booth same-origin fix
+
+The 2026-06-27 booth fix (commit 96fd97e) correctly blanked `apps/web/.env.production`'s
+`VITE_API_BASE` for the browser/booth same-origin case, but the desktop build shares that same
+file and was never given its own override — the desktop shell has been building with an empty
+API base since that commit, unnoticed until now. Symptom: login threw `DOMException: "The string
+did not match the expected pattern."` — WebKitGTK rejecting a relative `fetch()` URL with no base
+to resolve against, since the desktop window's origin is `tauri://localhost`. Browser login was
+unaffected (same-origin, no absolute URL needed), which is why this went unnoticed through the CI
+mirror-repo debugging session. Fixed by setting `VITE_API_BASE=http://127.0.0.1:3000` inline in
+`tauri.conf.json`'s `beforeBuildCommand`, overriding the shared `.env.production` for the desktop
+build only (process env wins in Vite's load order) — verified both builds independently. Full
+detail on [[desktop-shell-tauri]].