enable dev|prod envs with simpler env vars system

frontend/src/lib/client/api.ts

@@ -1,10 +1,6 @@
-const BASE_URL =
-	typeof window === 'undefined'
-		? typeof process !== 'undefined'
-			? process.env.PROXY_URL ||
-				`http://${process.env.SERVER_IP || '192.168.1.225'}:${process.env.PROXY_PORT || '3456'}`
-			: ''
-		: '';
+// Client-only. All /api calls go same-origin (vite proxy in dev, nginx in
+// prod). Server-side (SSR) calls use PROXY_URL from $app/env/public instead.
+const BASE_URL = '';
 
 async function memberFetch<T = unknown>(
     method: string,

frontend/src/lib/pocketbase.ts

@@ -1,7 +1,7 @@
 import PocketBase from 'pocketbase';
-import { PUBLIC_PB_URL } from '$app/env/public';
-
-export const pb = new PocketBase(PUBLIC_PB_URL);
+import { SERVER_IP } from '$app/env/public';
+const PB_ENDPOINT = import.meta.env.PROD ? '/pb' : `http://${SERVER_IP}:8090`;
+export const pb = new PocketBase(PB_ENDPOINT);
 pb.autoCancellation(false);
 
 export function initPbFromCookie() {

frontend/src/lib/server/auth.ts

@@ -1,8 +1,6 @@
 import { redirect } from '@sveltejs/kit';
 import type { RequestEvent } from '@sveltejs/kit';
-import { PROXY_URL } from '$lib/server/env';
-
-const HONO_URL = PROXY_URL;
+import { PROXY_URL } from '$app/env/public';
 
 export function getSession(event: RequestEvent) {
 	return event.locals.session;
@@ -17,7 +15,7 @@ export function requireAuth(event: RequestEvent) {
 }
 
 export async function signup(email: string, password: string, famName: string, parentName?: string) {
-	const res = await fetch(`${HONO_URL}/api/admin/signup`, {
+	const res = await fetch(`${PROXY_URL}/api/admin/signup`, {
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
 		body: JSON.stringify({ email, password, famName, parentName }),
@@ -29,7 +27,7 @@ export async function signup(email: string, password: string, famName: string, p
 
 export async function login(email: string, password: string) {
   console.log(email);
-	const res = await fetch(`${HONO_URL}/api/admin/login`, {
+	const res = await fetch(`${PROXY_URL}/api/admin/login`, {
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
 		body: JSON.stringify({ email, password }),
@@ -40,7 +38,7 @@ export async function login(email: string, password: string) {
 }
 
 export async function joinMember(inviteCode: string, name: string, deviceToken: string) {
-	const res = await fetch(`${HONO_URL}/api/members/join`, {
+	const res = await fetch(`${PROXY_URL}/api/members/join`, {
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
 		body: JSON.stringify({ inviteCode, name, deviceToken }),

frontend/src/lib/server/hono.ts

@@ -1,7 +1,5 @@
-import { PROXY_URL } from '$lib/server/env';
 import type { RequestEvent } from '@sveltejs/kit';
-
-const HONO_URL = PROXY_URL;
+import { PROXY_URL } from '$app/env/public';
 
 function sessionHeaders(event: RequestEvent): Record<string, string> {
 	const s = event.locals.session;
@@ -19,7 +17,7 @@ async function request(
 	body?: unknown,
 	headers?: Record<string, string>
 ) {
-	const res = await fetch(`${HONO_URL}${path}`, {
+	const res = await fetch(`${PROXY_URL}${path}`, {
 		method,
 		headers: headers || { 'Content-Type': 'application/json' },
 		body: body ? JSON.stringify(body) : undefined

frontend/src/lib/server/pb-admin.ts

@@ -1,4 +1,6 @@
-import { PB_ENDPOINT, PB_EMAIL, PB_PASSWORD } from './env';
+import { PB_EMAIL, PB_PASSWORD } from '$app/env/private';
+import { SERVER_IP } from '$app/env/public';
+export const PB_ENDPOINT = import.meta.env.PROD ? '/pb' : `http://${SERVER_IP}:8090`;
 
 let token: string | null = null;
 let tokenExpiry = 0;

frontend/src/lib/stores/fam.svelte.ts

@@ -67,7 +67,7 @@ class FamStore {
 
 	private initPromise: Promise<void> | null = null;
 
-	async init(famId: string) {
+	async init(famId: string, initialFam?: Fam) {
 		if (this.initialized && this.famId === famId) return;
 
 		// Wait for any in-flight init to finish first
@@ -82,8 +82,11 @@ class FamStore {
 
 		this.initPromise = (async () => {
 			try {
+				// fams is superadmin-only (non-realtime, one-way writes). It is always
+				// fetched server-side by the layout load and passed in — never via the
+				// unauthenticated client PB SDK.
+				this.fam = initialFam || this.fam || ({} as Fam);
 				const [
-					famRes,
 					membersRes,
 					templatesRes,
 					assignedRes,
@@ -93,7 +96,6 @@ class FamStore {
 					rewardsRes,
 					seasonsRes
 				] = await Promise.all([
-					pb.collection('fams').getOne(famId) as Promise<Fam>,
 					pb.collection('members').getFullList({ filter: `famId = '${famId}'` }) as Promise<
 						Member[]
 					>,
@@ -119,7 +121,6 @@ class FamStore {
 						Season[]
 					>
 				]);
-				this.fam = famRes;
 				this.members = membersRes;
 				this.templates = templatesRes;
 				this.assigned = assignedRes;