fix(operator,portal): env-driven sign-out URLs + host labels (no more .local in prod)

Operator sign-out hardcoded the dev Authentik end-session URL, so prod
logout landed on auth.dezky.local. Mirror the portal's env-driven pattern
(NUXT_PUBLIC_AUTH_URL/NUXT_PUBLIC_OPERATOR_URL with .local fallbacks).
Expose authUrl/operatorUrl via public runtimeConfig and use them for the
Authentik admin links and the cosmetic host labels (sidebar, eyebrows,
auth-page hints). Portal: signed-out + webmail copy now derive their hosts
from runtime config (new public.mailUrl, NUXT_PUBLIC_MAIL_URL in prod).

apps/operator/pages/not-authorized.vue

@@ -1,4 +1,5 @@
 <script setup lang="ts">
+const operatorHost = new URL(useRuntimeConfig().public.operatorUrl).host
 // Shown when an authenticated-but-non-operator session reaches the operator
 // portal (see middleware/require-platform-admin.global.ts). The account is
 // valid in Authentik but lacks platformAdmin — e.g. a partner or tenant user
@@ -42,7 +43,7 @@ onMounted(() => {
         continue.
       </p>
       <button class="primary" type="button" @click="signOut">Sign out now</button>
-      <p class="hint">operator.dezky.local</p>
+      <p class="hint">{{ operatorHost }}</p>
     </div>
   </div>
 </template>