Restrict apiFetch to same-origin /api/v1/ and lint colours in the build

apiFetch now refuses any path that does not resolve to a same-origin URL
under /api/v1/ before attaching X-MealQuest-CSRF or calling fetch, so the
cached CSRF token cannot be sent to another origin or another path.
npm run build runs lint:colors first, so a hex literal outside tokens.css
fails the production build.

Maestro task: f1bb5c9e-ca49-4a3c-b07d-7ed79f0e7fe5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "tsc --noEmit && vite build && npm run check:dist-fonts",
+    "build": "npm run lint:colors && tsc --noEmit && vite build && npm run check:dist-fonts",
     "preview": "vite preview",
     "typecheck": "tsc --noEmit",
     "test": "npm run lint:colors && vitest run",