Remove API URL UI; add username/password change in settings.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/api/client.ts

@@ -1,18 +1,11 @@
-const API_KEY = "eth_hedge_api_base";
 const TOKEN_KEY = "eth_hedge_token";
 const USER_KEY = "eth_hedge_user";
 
+/** 始终同源（经 dc.hyf2.cc 反代），不再暴露可改 API 地址。 */
 export function getApiBase(): string {
-  const saved = localStorage.getItem(API_KEY);
-  if (saved && saved.trim()) return saved.trim().replace(/\/$/, "");
-  // same-origin default when UI is served by backend on :5155
   return window.location.origin;
 }
 
-export function setApiBase(url: string) {
-  localStorage.setItem(API_KEY, url.trim().replace(/\/$/, ""));
-}
-
 export function getToken(): string | null {
   return localStorage.getItem(TOKEN_KEY);
 }
@@ -25,6 +18,7 @@ export function setSession(token: string, username: string) {
 export function clearSession() {
   localStorage.removeItem(TOKEN_KEY);
   localStorage.removeItem(USER_KEY);
+  localStorage.removeItem("eth_hedge_api_base");
 }
 
 export function getUsername(): string | null {
@@ -80,6 +74,17 @@ export async function login(username: string, password: string) {
   });
 }
 
+export async function changeCredentials(input: {
+  current_password: string;
+  new_username: string;
+  new_password: string;
+}) {
+  return apiFetch<LoginResult>("/api/auth/change-credentials", {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
 export type MarketSnapshot = {
   connected: boolean;
   updated_at_ms: number | null;