ci: prerender against the internal mesh API + fail loud if empty

The fedora-44 runner reaches the public internet (the CV gist on
api.github.com prerendered fine) but not the public rob.tn — split-horizon
DNS — so every moments-API-sourced route baked empty loading states while the
build still "succeeded". prefetchQuery swallows fetch errors, so the empty
snapshot shipped silently.

- Point VITE_API_BASE at the internal API the deploy already reaches
  (http://nikola.kosherinata.internal:42424/v1), verified reachable over the
  mesh. Only affects the SSR/prerender build; the browser bundle still uses the
  relative /api/v1.
- run-prerender.mjs now aborts (exit 1) if zero dynamic routes are enumerated,
  i.e. the API was unreachable — so an empty snapshot can never deploy again.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7zF7Kf4JqDwa6M8Qgge9M

.gitea/workflows/deploy.yml

@@ -48,9 +48,12 @@ env:
   API_UPSTREAM_SCHEME: http
   API_UPSTREAM_ADDR: nikola.kosherinata.internal:42424
   MUSL_TARGET: x86_64-unknown-linux-musl
-  # The prerender fetches the live public API at build time; the client bundle
-  # keeps the same-origin relative /api/v1 that nginx proxies.
-  VITE_API_BASE: https://rob.tn/api/v1
+  # Build-time prerender base: the runner is on the internal mesh and can't
+  # resolve/reach the public rob.tn, so fetch the API directly over the mesh
+  # (same host the deploy reaches). The api binary serves its routes under /v1.
+  # The client bundle still ships the same-origin relative /api/v1 that nginx
+  # proxies (VITE_API_BASE only affects the SSR build, not the browser bundle).
+  VITE_API_BASE: http://nikola.kosherinata.internal:42424/v1
   DEPLOY_KEY: |
     ${{ secrets.RSYNC_SSH_KEY }}
 

.gitea/workflows/refresh.yml

@@ -26,7 +26,9 @@ env:
   API_PORT: "42424"
   API_UPSTREAM_SCHEME: http
   API_UPSTREAM_ADDR: nikola.kosherinata.internal:42424
-  VITE_API_BASE: https://rob.tn/api/v1
+  # Internal mesh API base (the runner can't reach the public rob.tn); see
+  # deploy.yml. The api serves its routes under /v1.
+  VITE_API_BASE: http://nikola.kosherinata.internal:42424/v1
   DEPLOY_KEY: |
     ${{ secrets.RSYNC_SSH_KEY }}