fix(operator,portal): env-driven sign-out URLs + host labels (no more .local in prod)

Operator sign-out hardcoded the dev Authentik end-session URL, so prod
logout landed on auth.dezky.local. Mirror the portal's env-driven pattern
(NUXT_PUBLIC_AUTH_URL/NUXT_PUBLIC_OPERATOR_URL with .local fallbacks).
Expose authUrl/operatorUrl via public runtimeConfig and use them for the
Authentik admin links and the cosmetic host labels (sidebar, eyebrows,
auth-page hints). Portal: signed-out + webmail copy now derive their hosts
from runtime config (new public.mailUrl, NUXT_PUBLIC_MAIL_URL in prod).

apps/operator/pages/operator-team.vue

@@ -1,4 +1,5 @@
 <script setup lang="ts">
+const authUrl = useRuntimeConfig().public.authUrl
 import type { PlatformUser } from '~/types/user'
 
 const { data: users, pending, refresh } = await useFetch<PlatformUser[]>('/api/users', {
@@ -41,7 +42,7 @@ async function onInvited() {
           <template #leading><UiIcon name="refresh" :size="13" /></template>
           Refresh
         </UiButton>
-        <a href="https://auth.dezky.local/if/admin/" target="_blank" rel="noopener" class="link">
+        <a :href="`${authUrl}/if/admin/`" target="_blank" rel="noopener" class="link">
           <UiButton variant="secondary">
             <template #leading><UiIcon name="external" :size="13" /></template>
             Manage in Authentik