fix: replace hardcoded HEROKU URL with env-configurable API_BASE_URL

[swindar-zhou]

Linked issue

• Related # 386

Existing related work reviewed

• Issues/PRs reviewed: [Bug] Hardcoded Deployment URL in Base.Class.js #386
• If none found, write: None found after search

Overlap assessment

• Classification: No duplicate found
• Overlapping items: [Bug] Hardcoded Deployment URL in Base.Class.js #386 discusses deployment configuration concerns; no existing PR addresses the hardcoded URL directly
• Why this is not duplicate/superseded: [Bug] Hardcoded Deployment URL in Base.Class.js #386 identifies the problem; this PR is the implementation fix

Why this PR should proceed

• The hardcoded https://osemosys.herokuapp.com/ URL in source code prevents deployment to any server other than that specific Heroku app without manual edits. This fix removes that blocker with no breaking changes for local development

Summary

• What changed:
  • Removed static HEROKU = 0 flag and hardcoded https://osemosys.herokuapp.com/ URL from WebAPP/Classes/Base.Class.js
  • apiUrl() now resolves to window.API_BASE_URL || window.location.origin — no source code edit needed to change deployment target
  • API/Classes/Base/Config.py: added API_BASE_URL = os.environ.get("API_BASE_URL", "") and made HEROKU_DEPLOY env-driven via os.environ.get("HEROKU_DEPLOY", 0)
  • API/app.py: CORS Access-Control-Allow-Origin header now uses Config.API_BASE_URL if set, falls back to http://127.0.0.1; render_template passes api_base_url to index.html
  • WebAPP/index.html: injects window.API_BASE_URL from Flask before any scripts load
• Why:
  • The previous HEROKU = 1 code path hardcoded a specific Heroku app URL, requiring contributors to edit source code to deploy anywhere else
  • This blocks Docker, AWS, GCP, Azure, and any multi-user deployment without manual source changes
  • With this fix, setting API_BASE_URL=https://your-server.org in the environment is sufficient — local development requires no config at all (falls back to window.location.origin)

Validation

• Tests added/updated (or not applicable)
• Validation steps documented
• Evidence attached (logs/screenshots/output as relevant)

Validation steps:

1. Run locally without setting API_BASE_URL — confirm app loads and API calls resolve to window.location.origin
2. Set API_BASE_URL=https://your-server.org in .env and restart — confirm all API calls target that URL
3. Confirm window.API_BASE_URL is injected in page source via browser dev tools → View Page Source

Documentation

• Docs updated in this PR (or not applicable)
• Any setup/workflow changes reflected in repo docs

Scope check

• No unrelated refactors
• Implemented from a feature branch
• Change is deliverable without upstream OSeMOSYS/MUIO dependency
• Base repo/branch is EAPD-DRB/MUIOGO:main (not upstream)

Exception rationale

• Only for narrow docs/typo PRs that do not use a linked issue.
• Leave blank otherwise.