fix(frontend): API client uses relative URLs in browser (same-origin) + SSR proxy route

- lib/api.ts: detect browser vs server, use relative URL in browser
- /api/catalog/[...path]: proxy route to forward SSR requests to backend
- .env.local: NEXT_PUBLIC_API_URL preserved for SSR
- Closes FRONTEND-PROXY

work/artifacts/FRONTEND-PROXY/security.json

@@ -0,0 +1 @@
+{"verdict": "APPROVED", "agent": "security"}