feat: support explicit API URL for self-hosted deployments

[Leon-Luu]

Add optional HOPPSCOTCH_API_URL support so deployments with separate frontend and backend origins can use the MCP server without requiring a /backend reverse proxy under the frontend origin.

By default, behavior is unchanged:

• Cloud still maps https://hoppscotch.io to https://api.hoppscotch.io
• Self-hosted deployments still derive the API URL as <HOPPSCOTCH_SERVER_URL>/backend
• Existing users only setting HOPPSCOTCH_SERVER_URL continue to work as before

When HOPPSCOTCH_API_URL is set, it overrides the derived API URL while HOPPSCOTCH_SERVER_URL remains the frontend URL used for browser device login.

Why

Some self-hosted deployments serve the frontend and backend from different origins, for example:

HOPPSCOTCH_SERVER_URL=https://hoppscotch.example.com
HOPPSCOTCH_API_URL=https://api.hoppscotch.example.com

The current derivation assumes the backend is always available at:

<HOPPSCOTCH_SERVER_URL>/backend

That does not work for deployments where the backend is exposed through a separate domain or load balancer.

What's changed

• Add optional explicitApiUrl argument to deriveApiUrl()
• Read HOPPSCOTCH_API_URL in loadConfig()
• Validate HOPPSCOTCH_API_URL with the same URL validation used for HOPPSCOTCH_SERVER_URL
• Add HOPPSCOTCH_API_URL to TRUST_SENSITIVE_ENV_KEYS
• Add tests covering explicit API URL override and backwards-compatible default derivation

Behaviour

Checks

• Typecheck, lint, format check, unit tests, coverage, and build pass
• The production audit has no high or critical advisory
• Tests cover the behaviour change
• README.md and CHANGELOG.md are updated where required
• The diff contains no tokens, credentials, .env data, or unredacted logs

Notes to reviewers

npx tsc --noEmit
npx vitest run --exclude 'src/e2e/**'
npx tsup

[Leon-Luu]

@jamesgeorge007 can you have a look on this? Without this we can't use the MCP as selfhosted. Thanks