fix: rewrite asset and API paths for subdirectory deployments

index.html uses absolute /frontend/ paths for CSS and JS, and app.js
hardcoded const API = '/api'. In subdirectory deployments these resolve
to the wrong URL, causing unstyled HTML and broken API calls.

- index.php: rewrite /frontend/ references in index.html with detected basePath
- app.js: derive BASE_PATH from the script's own URL and prefix API calls

index.php

@@ -29,28 +29,30 @@ $file = __DIR__ . '/frontend' . $uri;
 $real_file = realpath($file);
 $frontend_dir = realpath(__DIR__ . '/frontend');
 
-if ($real_file === false || strpos($real_file, $frontend_dir) !== 0) {
+// Helper: serve index.html with asset paths rewritten for subdirectory deployments
+$serve_index = function() use ($basePath) {
     $index = __DIR__ . '/frontend/index.html';
     if (file_exists($index)) {
         header('Content-Type: text/html');
-        readfile($index);
+        $html = file_get_contents($index);
+        // Rewrite absolute /frontend/ paths to include the base path
+        if ($basePath) {
+            $html = str_replace('/frontend/', $basePath . '/frontend/', $html);
+        }
+        echo $html;
         exit;
     }
     http_response_code(404);
     echo 'Frontend not found';
     exit;
+};
+
+if ($real_file === false || strpos($real_file, $frontend_dir) !== 0) {
+    $serve_index();
 }
 
 if (!is_file($real_file)) {
-    $index = __DIR__ . '/frontend/index.html';
-    if (file_exists($index)) {
-        header('Content-Type: text/html');
-        readfile($index);
-        exit;
-    }
-    http_response_code(404);
-    echo 'Frontend not found';
-    exit;
+    $serve_index();
 }
 
 $ext = pathinfo($real_file, PATHINFO_EXTENSION);