Replace embedded flag with same-origin API probe

- Server serves frontend verbatim (drop window.PYSIM_EMBEDDED injection)
- Frontend probes /api/version once; res.ok -> relative base + cleared URL input,
  otherwise fall back to http://127.0.0.1:8080
- sw.js: never intercept/cache /api/* (live card data)

frontend/sw.js

@@ -32,6 +32,7 @@ self.addEventListener('activate', e => {
 
 self.addEventListener('fetch', e => {
   if (!e.request.url.startsWith('http')) return;
+  if (new URL(e.request.url).pathname.startsWith('/api/')) return;  // live data, never cache
   if (e.request.method !== 'GET') return;
   const isNavigate = e.request.mode === 'navigate' || e.request.url.endsWith('sw.js');
   if (isNavigate) {