fix(js): patch fetch to prepend ROOT_PATH for IIS reverse proxy

All relative /api/... calls automatically get /gomag prefix via
global fetch wrapper in shared.js. ROOT_PATH injected from template.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app/static/js/shared.js

@@ -1,5 +1,16 @@
 // shared.js - Unified utilities for all pages
 
+// ── Root path patch — prepend ROOT_PATH to all relative fetch calls ───────
+(function() {
+    const _fetch = window.fetch.bind(window);
+    window.fetch = function(url, ...args) {
+        if (typeof url === 'string' && url.startsWith('/') && window.ROOT_PATH) {
+            url = window.ROOT_PATH + url;
+        }
+        return _fetch(url, ...args);
+    };
+})();
+
 // ── HTML escaping ─────────────────────────────────
 function esc(s) {
     if (s == null) return '';

api/app/templates/base.html

@@ -27,8 +27,9 @@
         {% block content %}{% endblock %}
     </main>
 
+    <script>window.ROOT_PATH = "{{ rp }}";</script>
     <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/bootstrap.bundle.min.js"></script>
-    <script src="{{ rp }}/static/js/shared.js?v=9"></script>
+    <script src="{{ rp }}/static/js/shared.js?v=10"></script>
     {% block scripts %}{% endblock %}
 </body>
 </html>