fix(tauri-app): use absolute AppView URL for /api/profile fetch

The Tauri webview's origin is the Vite dev server (port 1430), not
the AppView (port 2584). A relative `fetch('/api/profile/…')`
resolves against Vite, which has no proxy configured, so the
request lands on Vite's 404 HTML page and `response.json()` then
throws `SyntaxError: The string did not match the expected
pattern.` The error surfaced as `err: SyntaxError…` under the
banner of the redesigned ProfileView.

Fix: expose the AppView base URL the Tauri shell was started with
as a sync `get_api_urls` Tauri command. The Rust side reads the
URL from `MAARCADETWEET_APPVIEW_URL` (default
`http://127.0.0.1:2584`) at startup and stores it on `AppState`
so the command doesn't need to re-read the env. The frontend
exposes a cached `getAppviewUrl()` helper; ProfileView's
`load()` uses it to build an absolute fetch URL.

The relative-path bug also affected the previous UserProfileView,
but it never errored loudly enough for the user to notice — the
new X-style layout made the err block visible.

crates/tauri-app/src/lib/api/client.ts

@@ -24,6 +24,33 @@ async function tauriCall<T>(cmd: string, fallback: T, args?: Record<string, unkn
   return invoke<T>(cmd, args);
 }
 
+/// Base URLs the Tauri shell was started with. Exposed via the
+/// `get_api_urls` command so the Svelte components can build
+/// absolute fetch URLs — a relative `/api/...` resolves against
+/// the Vite dev origin (port 1430), not the AppView (port 2584),
+/// and `response.json()` then throws `SyntaxError` on the 404
+/// HTML page. Cached after the first successful call.
+let _apiUrlsCache: { pdsUrl: string; appviewUrl: string } | null = null;
+
+export type ApiUrls = { pdsUrl: string; appviewUrl: string };
+
+/// Fetch the AppView + PDS base URLs from the Rust shell. Returns
+/// the cached value on subsequent calls.
+export async function getApiUrls(): Promise<ApiUrls> {
+  if (_apiUrlsCache) return _apiUrlsCache;
+  const urls = await safeInvoke<ApiUrls>("get_api_urls");
+  _apiUrlsCache = urls;
+  return urls;
+}
+
+/// Convenience: just the AppView base URL (the only one the UI
+/// currently needs for direct fetch calls). Same caching as
+/// `getApiUrls`.
+export async function getAppviewUrl(): Promise<string> {
+  const { appviewUrl } = await getApiUrls();
+  return appviewUrl;
+}
+
 /**
  * Strict variant of `tauriCall` for actions that MUST hit the
  * Tauri runtime (login, register, logout, post, like, etc.). In