fix(deploy): unify backend URL policy

frontend/src/api/runtime-config.ts

@@ -1,3 +1,5 @@
+import policy from "./backend-url-policy.json";
+
 export interface RuntimeConfig {
   backendBaseUrl?: string;
 }
@@ -10,17 +12,21 @@ declare global {
 
 export function resolveBackendUrl(config: RuntimeConfig | undefined): string {
   const value = config?.backendBaseUrl ?? import.meta.env.VITE_BACKEND_URL ?? "";
-  if (value === "" || value === "/" || value === "/api" || value === "/api/") return value;
+  if (policy.relativeBases.includes(value)) return value;
   try {
-    const url = new URL(value);
-    if ((url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password) {
-      return value;
-    }
+    if (!new RegExp(policy.absolutePattern).test(value)) throw new Error("syntax");
+    const authority = value.replace(/^https?:\/\//, "").split("/", 1)[0];
+    const suffix = authority.startsWith("[")
+      ? authority.slice(authority.indexOf("]") + 1)
+      : authority.slice(authority.lastIndexOf(":"));
+    const port = suffix.startsWith(":") ? suffix.slice(1) : "";
+    if (port && (port.length > 5 || Number(port) > policy.maxPort)) throw new Error("port");
+    return value;
   } catch {
     // Fall through to the single actionable runtime error below.
   }
   throw new Error(
-    "Invalid BACKEND_BASE_URL: use empty/root, /api, or an absolute http(s) URL without credentials",
+    "Invalid BACKEND_BASE_URL: use empty/root, /api, or a valid http(s) base without credentials, query, or fragment",
   );
 }