fix: require PB_URL in production, fall back to localhost in dev only

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/shared/api/client.ts

@@ -4,10 +4,8 @@ import type { ListResponse } from './types';
  * Native fetch wrapper for PocketBase API requests.
  */
 
-/* Prefer the server-only var (not exposed to the browser bundle),
- * fall back to the public var for client-side usage, then to the
- * local dev default. */
-const PB_URL = process.env.PB_URL ?? process.env.NEXT_PUBLIC_PB_URL ?? 'http://127.0.0.1:8090';
+/* Required in production; falls back to localhost in development. */
+const PB_URL = process.env.PB_URL ?? (process.env.NODE_ENV === 'development' ? 'http://127.0.0.1:8090' : undefined);
 
 /**
  * Options for PocketBase collection fetching.
@@ -43,6 +41,10 @@ export type PBFetchOptions = {
 export async function getCollection<T>(collection: string, options: PBFetchOptions = {}): Promise<ListResponse<T>> {
   const { sort, filter, expand, tags, revalidate } = options;
 
+  if (!PB_URL) {
+    throw new Error('PB_URL is required in production');
+  }
+
   const params = new URLSearchParams();
   if (sort) {
     params.set('sort', sort);