Aligns mock API_BASE with the real ApiClient's origin fallback

The mocks re-derived VITE_API_BASE_URL with their own fallback instead of
reusing getAppConfig().apiBaseUrl, so the two silently diverged whenever the
env var was unset (as in CI, where no local .env.local is present) — every
MSW-intercepted request then had no matching handler.

frontend/src/mocks/auth/fixtures.ts

@@ -1,7 +1,14 @@
 import type { AuthResponse, User } from '@/api/types';
+import { getAppConfig } from '@/lib/config';
 
-/** Base URL the ApiClient targets; mocks must match the absolute URL. */
+/**
-export const API_BASE = import.meta.env.VITE_API_BASE_URL ?? 'http://localhost:5000';
+ * Base URL the ApiClient targets; mocks must match it exactly. Reads the same
+ * getAppConfig().apiBaseUrl the real ApiClient is constructed with, rather than
+ * re-deriving VITE_API_BASE_URL with its own fallback — a second, diverging default here
+ * previously matched the real client's origin only when a local .env.local happened to set
+ * VITE_API_BASE_URL, and silently mismatched (all mocks unmatched) whenever it was unset, as in CI.
+ */
+export const API_BASE = getAppConfig().apiBaseUrl;
 
 export const TEST_CREDENTIALS = {
     email: 'owner@example.com',