fix: resolve mixed-content blocking by pointing webview at Flask HTTP directly

Tauri v2 served the frontend over https://tauri.localhost, causing
WebKit/WebView2 to block fetch() calls to the Flask sidecar on
http://localhost:8000 as mixed-content.

Solution: create the webview window pointing directly at Flask over
plain HTTP, so all requests are same-origin. No CORS needed.

- Add reqwest for health polling before window creation
- Remove auto-created window from tauri.conf.json
- Simplify API_BASE to empty string (same-origin)

Author: cutiips