feat: make backend worker API URL configurable via WORKER_API_URL

The backend worker API host/port was hardcoded to localhost:3060 in both the
worker (api.ts) and the web app that calls it (workerApi/actions.ts). Add a
WORKER_API_URL env var (default http://localhost:3060): the web app dials it,
and the worker derives its listen port from it, so the two can't drift.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: brendan-kellam

packages/backend/src/api.ts

@@ -14,7 +14,9 @@ import { SINGLE_TENANT_ORG_ID } from './constants.js';
 import z from 'zod';
 
 const logger = createLogger('api');
-const PORT = 3060;
+
+const workerApiUrl = new URL(env.WORKER_API_URL);
+const PORT = Number(workerApiUrl.port) || (workerApiUrl.protocol === "https:" ? 443 : 80);
 
 export class Api {
     private server: http.Server;

packages/shared/src/env.server.ts

@@ -172,6 +172,8 @@ const options = {
         // Zoekt
         ZOEKT_WEBSERVER_URL: z.string().url().default("http://localhost:6070"),
 
+        WORKER_API_URL: z.string().url().default("http://localhost:3060"),
+
         // Auth
         AUTH_SECRET: z.string(),
         AUTH_URL: z.string().url(),

packages/web/src/features/workerApi/actions.ts

@@ -5,9 +5,10 @@ import { unexpectedError } from "@/lib/serviceError";
 import { withAuth, withOptionalAuth } from "@/middleware/withAuth";
 import { withMinimumOrgRole } from "@/middleware/withMinimumOrgRole";
 import { OrgRole } from "@sourcebot/db";
+import { env } from "@sourcebot/shared";
 import z from "zod";
 
-const WORKER_API_URL = 'http://localhost:3060';
+const WORKER_API_URL = env.WORKER_API_URL;
 
 export const syncConnection = async (connectionId: number) => sew(() =>
     withAuth(({ role }) =>