Implement wiring hardening, runtime API config, smoke tests, and build scripts

frontend/electron/main.cjs

@@ -4,8 +4,18 @@ const fs = require('fs')
 
 const isDev = process.env.NODE_ENV !== 'production'
 const devUrl = 'http://localhost:5173'
+const API_URL_KEY = 'runtime_api_url'
+const DEFAULT_API_URL = process.env.VITE_API_URL || 'http://localhost:4000/api'
 let mainWindow
 
+function normalizeApiUrl(value) {
+  if (!value || typeof value !== 'string') return null
+  const trimmed = value.trim().replace(/\/+$/, '')
+  if (!trimmed) return null
+  if (!/^https?:\/\//i.test(trimmed)) return null
+  return /\/api$/i.test(trimmed) ? trimmed : `${trimmed}/api`
+}
+
 function getStoragePath() {
   return path.join(app.getPath('userData'), 'storage.json')
 }
@@ -31,9 +41,11 @@ function writeStorage(obj) {
   }
 }
 
-ipcMain.handle('storage-get', () => {
+ipcMain.handle('storage-get', (event, key) => {
   const s = readStorage()
-  return s
+  if (!key) return s
+  if (!(key in s)) return null
+  return { value: s[key] }
 })
 
 ipcMain.handle('storage-set', (event, key, value) => {
@@ -50,7 +62,20 @@ ipcMain.handle('storage-remove', (event, key) => {
   return true
 })
 
-ipcMain.handle('get-api-url', () => process.env.VITE_API_URL || 'http://localhost:4000/api')
+ipcMain.handle('get-api-url', () => {
+  const s = readStorage()
+  return normalizeApiUrl(s[API_URL_KEY]) || normalizeApiUrl(DEFAULT_API_URL) || 'http://localhost:4000/api'
+})
+
+ipcMain.handle('set-api-url', (event, value) => {
+  const next = normalizeApiUrl(value)
+  if (!next) throw new Error('API URL must be a valid http(s) URL')
+
+  const s = readStorage()
+  s[API_URL_KEY] = next
+  writeStorage(s)
+  return next
+})
 
 function createWindow() {
   mainWindow = new BrowserWindow({