fix(deploy): close container final review

frontend/src/api/runtime-config.ts

@@ -9,7 +9,19 @@ declare global {
 }
 
 export function resolveBackendUrl(config: RuntimeConfig | undefined): string {
-  return config?.backendBaseUrl ?? import.meta.env.VITE_BACKEND_URL ?? "";
+  const value = config?.backendBaseUrl ?? import.meta.env.VITE_BACKEND_URL ?? "";
+  if (value === "" || value === "/" || value === "/api" || value === "/api/") return value;
+  try {
+    const url = new URL(value);
+    if ((url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password) {
+      return value;
+    }
+  } catch {
+    // Fall through to the single actionable runtime error below.
+  }
+  throw new Error(
+    "Invalid BACKEND_BASE_URL: use empty/root, /api, or an absolute http(s) URL without credentials",
+  );
 }
 
 export function joinBackendPath(base: string, path: string): string {