fix(operator,portal): env-driven sign-out URLs + host labels (no more .local in prod)

Operator sign-out hardcoded the dev Authentik end-session URL, so prod
logout landed on auth.dezky.local. Mirror the portal's env-driven pattern
(NUXT_PUBLIC_AUTH_URL/NUXT_PUBLIC_OPERATOR_URL with .local fallbacks).
Expose authUrl/operatorUrl via public runtimeConfig and use them for the
Authentik admin links and the cosmetic host labels (sidebar, eyebrows,
auth-page hints). Portal: signed-out + webmail copy now derive their hosts
from runtime config (new public.mailUrl, NUXT_PUBLIC_MAIL_URL in prod).

apps/operator/server/api/auth/sign-out.get.ts

@@ -10,15 +10,20 @@
 //   3. 302 the BROWSER through Authentik's dezky-operator end-session URL
 //      with post_logout_redirect_uri=/signed-out.
 //
-// The brief URL-bar flash to auth.dezky.local is unavoidable: that's the
+// The brief URL-bar flash to the Authentik host is unavoidable: that's the
 // only host that can clear the Authentik session cookie (server-to-server
 // invalidation alone leaves the browser cookie, which would let the next
 // visit silently re-authorize).
 
 import { getUserSession, clearUserSession } from 'nuxt-oidc-auth/runtime/server/utils/session.js'
 
-const END_SESSION = 'https://auth.dezky.local/application/o/dezky-operator/end-session/'
-const POST_LOGOUT_REDIRECT = 'https://operator.dezky.local/signed-out'
+// Environment-driven so one build serves dev (.local) and prod (.eu) — same
+// pattern as the customer portal's sign-out.
+const AUTH_URL = (process.env.NUXT_PUBLIC_AUTH_URL || 'https://auth.dezky.local').replace(/\/$/, '')
+const OPERATOR_URL = (process.env.NUXT_PUBLIC_OPERATOR_URL || 'https://operator.dezky.local').replace(/\/$/, '')
+const OIDC_APP_SLUG = process.env.OPERATOR_OIDC_APP_SLUG || 'dezky-operator'
+const END_SESSION = `${AUTH_URL}/application/o/${OIDC_APP_SLUG}/end-session/`
+const POST_LOGOUT_REDIRECT = `${OPERATOR_URL}/signed-out`
 
 export default defineEventHandler(async (event) => {
   const session = await getUserSession(event).catch(() => ({} as any))