fix: build share urls from auth_url instead of localhost

docker build sets next_public_app_url to localhost; preferring it over
runtime auth_url made prod share links point at localhost:3000.

src/lib/app-url.ts

@@ -0,0 +1,8 @@
+/** Public origin for absolute links. AUTH_URL wins — Docker build sets NEXT_PUBLIC to localhost. */
+export function getAppPublicUrl(): string {
+  const raw =
+    process.env.AUTH_URL?.trim() ||
+    process.env.NEXT_PUBLIC_APP_URL?.trim() ||
+    "http://localhost:3000";
+  return raw.replace(/\/$/, "");
+}