Fix double /api/ prefix in API endpoint calls

When VITE_API_URL=/api, axios baseURL is already set to /api. However, all endpoint calls included the /api/ prefix, creating double paths like /api/api/auth/login/.

Removed /api/ prefix from 81 API endpoint calls across 22 files:
- src/api/auth.ts - Fixed login, logout, me, refresh, hijack endpoints
- src/api/client.ts - Fixed token refresh endpoint
- src/api/profile.ts - Fixed all profile, email, password, MFA, sessions endpoints
- src/hooks/*.ts - Fixed all remaining API calls (users, appointments, resources, etc)
- src/pages/*.tsx - Fixed signup and email verification endpoints

This ensures API requests use the correct path: /api/auth/login/ instead of /api/api/auth/login/

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/src/api/mfa.ts

@@ -90,7 +90,7 @@ export interface MFAVerifyResponse {
  * Get current MFA status
  */
 export const getMFAStatus = async (): Promise<MFAStatus> => {
-  const response = await apiClient.get<MFAStatus>('/api/auth/mfa/status/');
+  const response = await apiClient.get<MFAStatus>('/auth/mfa/status/');
   return response.data;
 };
 
@@ -102,7 +102,7 @@ export const getMFAStatus = async (): Promise<MFAStatus> => {
  * Send phone verification code
  */
 export const sendPhoneVerification = async (phone: string): Promise<{ success: boolean; message: string }> => {
-  const response = await apiClient.post('/api/auth/mfa/phone/send/', { phone });
+  const response = await apiClient.post('/auth/mfa/phone/send/', { phone });
   return response.data;
 };
 
@@ -110,7 +110,7 @@ export const sendPhoneVerification = async (phone: string): Promise<{ success: b
  * Verify phone number with code
  */
 export const verifyPhone = async (code: string): Promise<{ success: boolean; message: string }> => {
-  const response = await apiClient.post('/api/auth/mfa/phone/verify/', { code });
+  const response = await apiClient.post('/auth/mfa/phone/verify/', { code });
   return response.data;
 };
 
@@ -118,7 +118,7 @@ export const verifyPhone = async (code: string): Promise<{ success: boolean; mes
  * Enable SMS MFA (requires verified phone)
  */
 export const enableSMSMFA = async (): Promise<MFAEnableResponse> => {
-  const response = await apiClient.post<MFAEnableResponse>('/api/auth/mfa/sms/enable/');
+  const response = await apiClient.post<MFAEnableResponse>('/auth/mfa/sms/enable/');
   return response.data;
 };
 
@@ -130,7 +130,7 @@ export const enableSMSMFA = async (): Promise<MFAEnableResponse> => {
  * Initialize TOTP setup (returns QR code and secret)
  */
 export const setupTOTP = async (): Promise<TOTPSetupResponse> => {
-  const response = await apiClient.post<TOTPSetupResponse>('/api/auth/mfa/totp/setup/');
+  const response = await apiClient.post<TOTPSetupResponse>('/auth/mfa/totp/setup/');
   return response.data;
 };
 
@@ -138,7 +138,7 @@ export const setupTOTP = async (): Promise<TOTPSetupResponse> => {
  * Verify TOTP code to complete setup
  */
 export const verifyTOTPSetup = async (code: string): Promise<MFAEnableResponse> => {
-  const response = await apiClient.post<MFAEnableResponse>('/api/auth/mfa/totp/verify/', { code });
+  const response = await apiClient.post<MFAEnableResponse>('/auth/mfa/totp/verify/', { code });
   return response.data;
 };
 
@@ -150,7 +150,7 @@ export const verifyTOTPSetup = async (code: string): Promise<MFAEnableResponse>
  * Generate new backup codes (invalidates old ones)
  */
 export const generateBackupCodes = async (): Promise<BackupCodesResponse> => {
-  const response = await apiClient.post<BackupCodesResponse>('/api/auth/mfa/backup-codes/');
+  const response = await apiClient.post<BackupCodesResponse>('/auth/mfa/backup-codes/');
   return response.data;
 };
 
@@ -158,7 +158,7 @@ export const generateBackupCodes = async (): Promise<BackupCodesResponse> => {
  * Get backup codes status
  */
 export const getBackupCodesStatus = async (): Promise<BackupCodesStatus> => {
-  const response = await apiClient.get<BackupCodesStatus>('/api/auth/mfa/backup-codes/status/');
+  const response = await apiClient.get<BackupCodesStatus>('/auth/mfa/backup-codes/status/');
   return response.data;
 };
 
@@ -170,7 +170,7 @@ export const getBackupCodesStatus = async (): Promise<BackupCodesStatus> => {
  * Disable MFA (requires password or valid MFA code)
  */
 export const disableMFA = async (credentials: { password?: string; mfa_code?: string }): Promise<{ success: boolean; message: string }> => {
-  const response = await apiClient.post('/api/auth/mfa/disable/', credentials);
+  const response = await apiClient.post('/auth/mfa/disable/', credentials);
   return response.data;
 };
 
@@ -182,7 +182,7 @@ export const disableMFA = async (credentials: { password?: string; mfa_code?: st
  * Send MFA code for login (SMS only)
  */
 export const sendMFALoginCode = async (userId: number, method: 'SMS' | 'TOTP' = 'SMS'): Promise<{ success: boolean; message: string; method: string }> => {
-  const response = await apiClient.post('/api/auth/mfa/login/send/', { user_id: userId, method });
+  const response = await apiClient.post('/auth/mfa/login/send/', { user_id: userId, method });
   return response.data;
 };
 
@@ -195,7 +195,7 @@ export const verifyMFALogin = async (
   method: 'SMS' | 'TOTP' | 'BACKUP',
   trustDevice: boolean = false
 ): Promise<MFAVerifyResponse> => {
-  const response = await apiClient.post<MFAVerifyResponse>('/api/auth/mfa/login/verify/', {
+  const response = await apiClient.post<MFAVerifyResponse>('/auth/mfa/login/verify/', {
     user_id: userId,
     code,
     method,
@@ -212,7 +212,7 @@ export const verifyMFALogin = async (
  * List trusted devices
  */
 export const listTrustedDevices = async (): Promise<{ devices: TrustedDevice[] }> => {
-  const response = await apiClient.get('/api/auth/mfa/devices/');
+  const response = await apiClient.get('/auth/mfa/devices/');
   return response.data;
 };
 
@@ -220,7 +220,7 @@ export const listTrustedDevices = async (): Promise<{ devices: TrustedDevice[] }
  * Revoke a specific trusted device
  */
 export const revokeTrustedDevice = async (deviceId: number): Promise<{ success: boolean; message: string }> => {
-  const response = await apiClient.delete(`/api/auth/mfa/devices/${deviceId}/`);
+  const response = await apiClient.delete(`/auth/mfa/devices/${deviceId}/`);
   return response.data;
 };
 
@@ -228,6 +228,6 @@ export const revokeTrustedDevice = async (deviceId: number): Promise<{ success:
  * Revoke all trusted devices
  */
 export const revokeAllTrustedDevices = async (): Promise<{ success: boolean; message: string; count: number }> => {
-  const response = await apiClient.delete('/api/auth/mfa/devices/revoke-all/');
+  const response = await apiClient.delete('/auth/mfa/devices/revoke-all/');
   return response.data;
 };