fix(deploy): close container final review

docker/frontend-entrypoint.sh

@@ -1,7 +1,20 @@
 #!/bin/sh
 set -eu
 
-backend_base_url=${BACKEND_BASE_URL:-/api}
+backend_base_url=${BACKEND_BASE_URL-/api}
+case "$backend_base_url" in
+  ""|/|/api|/api/) ;;
+  http://*|https://*)
+    if printf '%s' "$backend_base_url" | grep -Eq '[[:space:]]|^https?://[^/]*@'; then
+      echo "Invalid BACKEND_BASE_URL: credentials and whitespace are not allowed" >&2
+      exit 2
+    fi
+    ;;
+  *)
+    echo "Invalid BACKEND_BASE_URL: use empty/root, /api, or an absolute http(s) URL" >&2
+    exit 2
+    ;;
+esac
 runtime_config=$(jq -cn --arg backend_base_url "$backend_base_url" \
   '{backendBaseUrl: $backend_base_url}')
 printf 'window.__THOTHII_CONFIG__ = %s;\n' "$runtime_config" \