fix: Use uri-path instead of :external representation for API detection

- Replace uri-to-url with :representation :external with uri-path
- Fixes issue where full URLs like http://asteroid.radio.localhost were generated
- .localhost domains resolve to 127.0.0.1 which breaks on remote servers
- Path-only approach works for both local and remote deployments
- Follows Radiance best practices: :external is only for redirect URLs

user-management.lisp

@@ -175,7 +175,7 @@
    If :api t, returns JSON error (401). Otherwise redirects to login page.
    Auto-detects API routes if not specified."
   (let* ((user-id (session:field "user-id"))
-         (uri (uri-to-url (radiance:uri *request*) :representation :external))
+         (uri (uri-path (radiance:uri *request*)))
          ;; Use explicit flag if provided, otherwise auto-detect from URI
          (is-api-request (if api t (search "/api/" uri))))
     (format t "Authentication check - User ID: ~a, URI: ~a, Is API: ~a~%" 
@@ -202,7 +202,7 @@
    If :api t, returns JSON error (403). Otherwise redirects to login page.
    Auto-detects API routes if not specified."
   (let* ((current-user (get-current-user))
-         (uri (uri-to-url (radiance:uri *request*) :representation :external))
+         (uri (uri-path (radiance:uri *request*)))
          ;; Use explicit flag if provided, otherwise auto-detect from URI
          (is-api-request (if api t (search "/api/" uri))))
     (format t "Current user for role check: ~a~%" (if current-user "FOUND" "NOT FOUND"))