Fix Mixed Content issue on staging (HTTPS/HTTP mismatch)

- Add Next.js API rewrites to proxy /api and /uploads requests
- Update docker-compose.staging.yml to use relative API paths
- Set NEXT_PUBLIC_API_URL to empty for staging (use rewrites)
- Add BACKEND_URL env var for Next.js server-side proxying
- Update all files to use relative paths when API_URL is empty

This fixes the issue where the staging site (HTTPS) was trying to
load resources from HTTP backend, causing Mixed Content errors.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

frontend/src/lib/api.ts

@@ -1,10 +1,12 @@
 import axios from 'axios';
 import { Car, CarListResponse, CarMaker, CarModel, User, HeroBanner, HeroBannerSettings, CarView } from '@/types';
 
-const API_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:8000';
+// When NEXT_PUBLIC_API_URL is empty, use relative path (for HTTPS proxy setup)
+const API_URL = process.env.NEXT_PUBLIC_API_URL;
+const BASE_URL = API_URL ? `${API_URL}/api` : '/api';
 
 const api = axios.create({
-  baseURL: `${API_URL}/api`,
+  baseURL: BASE_URL,
   headers: {
     'Content-Type': 'application/json',
   },
@@ -931,7 +933,7 @@ export const ccApi = {
   // Get PDF URL for iframe/embed viewing
   getPerformanceCheckPdfUrl: (carId: number): string => {
     const token = typeof window !== 'undefined' ? localStorage.getItem('token') : null;
-    const baseUrl = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:8000';
+    const baseUrl = process.env.NEXT_PUBLIC_API_URL || '';
     return `${baseUrl}/api/carmodoo/car/${carId}/performance-check/pdf`;
   },
 };