[Bug]: Fix server-mode URL joining in createFetchWithAuth

[Bccorb]

What happened?

Summary

createFetchWithAuth() currently builds server mode URLs by concatenating authHost and auth directly. If apiHost does not end with /, requests become invalid, e.g. https://api.example.comauth/... instead of https://api.example.com/auth/....

This conflicts with the documented contract and can break real consumers using mode="server".

Current behavior

In src/fetchWithAuth.ts, server mode uses:

• authHost
• auth
• request path

without normalizing slashes first.

Example broken case:

• apiHost = "https://api.example.com"
• expected: https://api.example.com/auth/users/me
• actual: https://api.example.comauth/users/me

Related files

• src/fetchWithAuth.ts
• tests/fetchWithAuth.test.tsx
• README.md

Steps to Reproduce

Create a new application and make the AUTH_SERVER value NOT have a / at the end.

Expected Behavior

Acceptance criteria

• server mode correctly targets ${apiHost}/auth/...
• Works whether apiHost is:
  • https://api.example.com
  • https://api.example.com/
• Existing tests are updated to reflect the intended contract
• Add test coverage for both normalized and non-normalized inputs

Environment

No response

Logs / stack traces