Rollup 4.57.0 has arbitrary file write via path traversal
(GHSA-mw96-cpmx-2vgc). Added pnpm override to force >=4.59.0.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Frontend API client prefixes all paths with /api/ (e.g. /api/projects,
/api/knowledge/entries) but backend controllers had no global prefix,
causing 404s on all data-fetching pages in production.
- Add setGlobalPrefix('api') in main.ts with exclusions for /health
(Docker healthcheck) and /auth/* (BetterAuth OAuth flow)
- Strip redundant 'api/' from federation and CSRF controller paths
that already included the prefix manually
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>