fix(operator,portal): env-driven sign-out URLs + host labels (no more .local in prod)

Operator sign-out hardcoded the dev Authentik end-session URL, so prod
logout landed on auth.dezky.local. Mirror the portal's env-driven pattern
(NUXT_PUBLIC_AUTH_URL/NUXT_PUBLIC_OPERATOR_URL with .local fallbacks).
Expose authUrl/operatorUrl via public runtimeConfig and use them for the
Authentik admin links and the cosmetic host labels (sidebar, eyebrows,
auth-page hints). Portal: signed-out + webmail copy now derive their hosts
from runtime config (new public.mailUrl, NUXT_PUBLIC_MAIL_URL in prod).

apps/operator/nuxt.config.ts

@@ -16,6 +16,15 @@ export default defineNuxtConfig({
 
   modules: ['nuxt-oidc-auth'],
 
+  runtimeConfig: {
+    public: {
+      // Overridable at runtime via NUXT_PUBLIC_AUTH_URL / NUXT_PUBLIC_OPERATOR_URL
+      // (both set in production). Used for Authentik links and host labels.
+      authUrl: AUTH_URL,
+      operatorUrl: OPERATOR_URL,
+    },
+  },
+
   css: ['~/assets/styles/tokens.css', '~/assets/styles/base.css'],
 
   // Auto-import from the shared packages/ui workspace in addition to the