fix(operator,portal): env-driven sign-out URLs + host labels (no more .local in prod)

Operator sign-out hardcoded the dev Authentik end-session URL, so prod
logout landed on auth.dezky.local. Mirror the portal's env-driven pattern
(NUXT_PUBLIC_AUTH_URL/NUXT_PUBLIC_OPERATOR_URL with .local fallbacks).
Expose authUrl/operatorUrl via public runtimeConfig and use them for the
Authentik admin links and the cosmetic host labels (sidebar, eyebrows,
auth-page hints). Portal: signed-out + webmail copy now derive their hosts
from runtime config (new public.mailUrl, NUXT_PUBLIC_MAIL_URL in prod).

apps/operator/components/OpSidebar.vue

@@ -1,4 +1,5 @@
 <script setup lang="ts">
+const operatorHost = new URL(useRuntimeConfig().public.operatorUrl).host
 import type { IconName } from './UiIcon.vue'
 
 interface NavItem {
@@ -45,7 +46,7 @@ const isSection = (r: NavRow): r is NavSection => 'sec' in r
       <span class="tile"><NodeMark :size="22" fg="#F4F3EE" accent="#D4FF3A" /></span>
       <div v-if="!collapsed" class="brand-meta">
         <div class="brand-name">dezky · ops</div>
-        <div class="brand-host">operator.dezky.local</div>
+        <div class="brand-host">{{ operatorHost }}</div>
       </div>
     </div>