Point the panel link at the installation, not at the browser's origin

Both links out of the dashboard editor were built root-relative, so a portal
serving the app under `/i/{id}` got a URL to itself: the hub has no route
there and answers a bare 404. That is what a device link and "open what a
wall panel sees" both landed on.

They want different answers. The view link is for the person already looking,
so it takes the router's basepath — `appPath` in `lib/portal` is the same
prefix the router applies to every `Link`, for the places that step outside
it. The device link is for a screen, which cannot go through the portal at
all: the shell is served only to a portal session, and the credential that
page carries is the portal's rather than the panel's. So the server now says
where it answers, and `FRONTEND_HOST` is that answer — the same setting the
password-reset links already use.

Also fixes the panel branch in the query error handler, which compared a raw
pathname and so never fired under a portal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AHpLJHozysQXjsxAyU1WHj

frontend/src/main.tsx

@@ -13,7 +13,7 @@ import { ThemeProvider } from "./components/theme-provider"
 import { Toaster } from "./components/ui/sonner"
 import "./index.css"
 import { connectionStore, offlineDetail } from "./lib/connectionStore"
-import { apiToken, portalConfig } from "./lib/portal"
+import { apiToken, appPath, appRoute, portalConfig } from "./lib/portal"
 import { routeTree } from "./routeTree.gen"
 
 const portal = portalConfig()
@@ -43,10 +43,10 @@ const handleApiError = (error: Error) => {
     // new code instead. Only a 401 is worth throwing its credential away for:
     // a 403 there is a dashboard it was just unassigned from, which the next
     // read of the panel corrects on its own.
-    if (window.location.pathname.startsWith("/panel")) {
+    if (appRoute().startsWith("/panel")) {
       if (error instanceof ApiError && error.status === 401) {
         localStorage.removeItem("access_token")
-        window.location.href = "/panel"
+        window.location.href = appPath("/panel")
       }
       return
     }
@@ -57,7 +57,7 @@ const handleApiError = (error: Error) => {
       return
     }
     localStorage.removeItem("access_token")
-    window.location.href = "/login"
+    window.location.href = appPath("/login")
   }
 }