Make Clerk sign-in work on the static GitHub Pages build (dashban.com)

[super3]

Problem

Clicking Sign in with GitHub on https://dashban.com does nothing.

dashban.com is served by GitHub Pages (static, no backend). The frontend made same-origin calls — fetch('/api/config') and /api/github/... — which 404 on Pages, so Clerk never initialized and the button no-oped. (Sign-in already works fine when the app is opened directly on its Railway URL, which serves both the frontend and the API.)

Fix

Mirror the pattern already proven in super3/padtask: keep the static frontend on GitHub Pages and reach the backend on its own Railway origin, cross-origin. No DNS change — dashban.com stays on Pages.

• server.js — app.use(cors()) so the Pages origin can call the API. The GitHub proxy still requires a valid Clerk session token, so opening CORS grants no access on its own.
• src/github-auth.js — new origin-aware getApiBase(): relative paths on localhost / when served by the backend, the absolute Railway URL (https://dashban-production.up.railway.app) for a static host like dashban.com. The authenticated proxy request routes through it.
• src/clerk-auth.js — fetchConfig() now uses getApiBase() to reach /api/config cross-origin, and initialize() falls back to the built-in browser-safe publishable key so Clerk still initializes if the backend config is momentarily unreachable.

How padtask does it (verified)

Piece	padtask
Frontend	GitHub Pages on padtask.com
Backend	separate Railway service (padtask-production.up.railway.app)
Reaching it	API_BASE absolute URL, chosen by hostname
Cross-origin	app.use(cors()) → access-control-allow-origin: *
Clerk init	client-side publishable key, no backend round-trip required

Deployment notes

• No DNS change — dashban.com remains on GitHub Pages.
• Requires CLERK_SECRET_KEY set on the Railway service (already configured).
• Cross-origin requests rely on the CORS change in this PR being deployed to Railway.

Testing

• npm test — 959 passing (6 new: getApiBase branches, fetchConfig base-URL handling, the built-in-key fallback, and a CORS header check).
• npm run test:coverage — 100% statements/branches/functions/lines across all files including server.js, github-auth.js, clerk-auth.js.
• npm run lint — 0 errors (7 pre-existing warnings unchanged).

🤖 Generated with Claude Code

https://claude.ai/code/session_019VQjXJyM3EZPd4joy3EwaB

---

Generated by Claude Code