fix: rewrite asset and API paths for subdirectory deployments

index.html uses absolute /frontend/ paths for CSS and JS, and app.js
hardcoded const API = '/api'. In subdirectory deployments these resolve
to the wrong URL, causing unstyled HTML and broken API calls.

- index.php: rewrite /frontend/ references in index.html with detected basePath
- app.js: derive BASE_PATH from the script's own URL and prefix API calls

frontend/app.js

@@ -1,6 +1,19 @@
 /* Protocol Droid — Frontend Application */
 
-const API = '/api';
+/* Detect base path from the script's own URL for subdirectory deployments */
+/* app.js is loaded from <base>/frontend/app.js, so base = everything before /frontend/app.js */
+(function() {
+  var scripts = document.getElementsByTagName('script');
+  for (var i = 0; i < scripts.length; i++) {
+    var src = scripts[i].src || '';
+    var m = src.match(/^https?:\/\/[^/]+(\/.*)?\/frontend\/app\.js$/);
+    if (m) {
+      window.BASE_PATH = m[1] || '';
+      break;
+    }
+  }
+})();
+const API = (window.BASE_PATH || '') + '/api';
 let currentUser = null;
 let siteConfig = {};
 let allTags = [];
@@ -835,4 +848,4 @@ function formatDate(s) {
 }
 
 // --- Boot ---
-init();
+init();