[Bug Bash] Generated SWA App didn't fully work

The website loaded, but has this error at the bottom of the main UI: Couldn't loadFailed to mint dev token: HTTP 404

I asked Copilot to fix it, which it did, and said this was the problem.

SPA hardcoded /api/* paths — liveClient.ts called fetch('/api/auth/token', ...) as a same-origin path. Since the SPA is served from thankful-meadow-0373d930f.5.azurestaticapps.net, that resolved to SWA's managed-API route (which doesn't exist on Free tier) → 404. VITE_API_BASE_URL was baked into the bundle but never read. Fixed by introducing an apiUrl() helper that prepends VITE_API_BASE_URL (or falls back to /api for the Vite dev proxy).

authTokenDev returned 404 because NODE_ENV=production — authToken.ts treated the standard prod signal as the kill switch. Even if problem #1 hadn't existed, the endpoint would still 404 in production. Switched the gate to a dedicated ALLOW_DEV_AUTH=true app setting (wired into function-app.bicep), so NODE_ENV=production can stay set correctly.

Start with the SPA request logic in liveClient.ts, the development-token handling in authToken.ts, and the deployment setting in function-app.bicep. Reproduce the generated SWA app failure and verify that the deployed API request reaches its configured endpoint and that development token minting succeeds without breaking production configuration.