fix(manacore-web,todo-web): use runtime URLs for backend API services

- manacore-web: Update todo, calendar, contacts service files to use
  runtime URLs from window instead of import.meta.env (baked at build time)
- manacore-web: Add backend URL env vars to docker-compose.staging.yml
- manacore-web: Fix fallback ports (todo: 3017→3018, calendar: 3014→3016)
- todo-web: Update API client to use runtime URL from window

This enables Docker containers to use runtime-injected URLs instead of
build-time environment variables.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

apps/todo/apps/web/src/lib/api/client.ts

@@ -12,12 +12,28 @@ interface ApiError {
 	statusCode: number;
 }
 
+/**
+ * Get the backend URL, preferring runtime-injected value in browser
+ * This allows Docker to inject PUBLIC_BACKEND_URL_CLIENT at runtime
+ * instead of using the build-time PUBLIC_BACKEND_URL
+ */
+function getBackendUrl(): string {
+	if (browser && typeof window !== 'undefined') {
+		const runtimeUrl = (window as Window & { __PUBLIC_BACKEND_URL__?: string })
+			.__PUBLIC_BACKEND_URL__;
+		if (runtimeUrl) {
+			return runtimeUrl;
+		}
+	}
+	return PUBLIC_BACKEND_URL || 'http://localhost:3018';
+}
+
 class ApiClient {
-	private baseUrl: string;
 	private accessToken: string | null = null;
 
-	constructor() {
-		this.baseUrl = PUBLIC_BACKEND_URL || 'http://localhost:3018';
+	// Use getter to evaluate URL at request time (browser may hydrate after construction)
+	private get baseUrl(): string {
+		return getBackendUrl();
 	}
 
 	setAccessToken(token: string | null) {