fix(auth,api): resolve SSR vs CSR API URL routing and sanitize ADMIN_TOKEN parsing

- Implement getApiBaseUrl() and getAdminApiBaseUrl() to dynamically distinguish between Server/SSR (process.env.API_BASE_URL) and Client/CSR (process.env.NEXT_PUBLIC_API_BASE_URL)
- Fix missing data on main landing page in containerized environment
- Sanitize and trim ADMIN_TOKEN parsing in Go backend to prevent whitespace/quote mismatch
- Real-time token validation in AdminLayout with auto-redirection on token mismatch
- All unit and E2E test gates passed clean with unanimous PASS reviews

backend/internal/config/config.go

@@ -94,7 +94,7 @@ func Load() *Config {
 	}
 
 	if token := os.Getenv("ADMIN_TOKEN"); token != "" {
-		cfg.AdminToken = token
+		cfg.AdminToken = strings.Trim(token, " \"'\r\n\t")
 	}
 
 	if autoMigrateStr := os.Getenv("AUTO_MIGRATE"); autoMigrateStr != "" {

backend/internal/httpx/auth.go

@@ -8,8 +8,9 @@ import (
 
 // RequireAdminToken returns a Gin middleware that validates Bearer <token> against the configured admin token.
 func RequireAdminToken(adminToken string) gin.HandlerFunc {
+	expectedToken := strings.Trim(adminToken, " \"'\r\n\t")
 	return func(c *gin.Context) {
-		if adminToken == "" {
+		if expectedToken == "" {
 			Unauthorized(c, "Admin API is disabled: ADMIN_TOKEN is not configured")
 			c.Abort()
 			return
@@ -23,7 +24,7 @@ func RequireAdminToken(adminToken string) gin.HandlerFunc {
 		}
 
 		parts := strings.SplitN(auth, " ", 2)
-		if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") || parts[1] != adminToken {
+		if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") || strings.TrimSpace(parts[1]) != expectedToken {
 			Unauthorized(c, "Invalid admin bearer token")
 			c.Abort()
 			return