fix: use public base URL for login redirects

[bionicman]

Description

In a self-hosted standalone deployment behind a reverse proxy, Next.js constructs the middleware request URL from the internal listener address. As a result, visiting / could redirect users to an internal URL such as https://localhost:3000/login, even when the proxy forwards the public host and protocol correctly.

Use the configured NEXT_PUBLIC_BASE_URL as the origin for the self-hosted login redirect. This is already Kan's canonical installation URL and is also used by the authentication setup and other absolute links. The request URL remains the fallback when the public base URL is missing or empty.

This deliberately does not derive the redirect target from Host or X-Forwarded-Host, which would require an explicit trusted-proxy boundary and could otherwise allow host-header-driven redirects.

Reproduction

Run the standalone server behind a TLS-terminating reverse proxy and request / with a public host:

curl -I -H 'Host: kan.example.com' -H 'X-Forwarded-Proto: https' http://127.0.0.1:3000/

Before this change, the response points to the internal listener:

Location: https://localhost:3000/login

After this change, with NEXT_PUBLIC_BASE_URL=https://kan.example.com:

Location: https://kan.example.com/login

Type of change

• Bug fix
• Feature (requires an approved issue — see below)
• Refactor / chore
• Documentation

Checklist

• I have linked the related issue below
• My code follows the existing style and conventions
• I have tested my changes locally
• I have included screenshots for any UI changes

Testing

• pnpm --filter @kan/web test — 11 tests passed
• Prettier check for the changed files
• ESLint check for the changed files
• git diff --check upstream/main...HEAD
• reproduced against an unmodified standalone build behind forwarded host/protocol headers

Linked issue

Not applicable: this is a self-hosting bug fix and does not change intended product behavior.