fix(operator,portal): env-driven sign-out URLs + host labels (no more .local in prod)

Operator sign-out hardcoded the dev Authentik end-session URL, so prod
logout landed on auth.dezky.local. Mirror the portal's env-driven pattern
(NUXT_PUBLIC_AUTH_URL/NUXT_PUBLIC_OPERATOR_URL with .local fallbacks).
Expose authUrl/operatorUrl via public runtimeConfig and use them for the
Authentik admin links and the cosmetic host labels (sidebar, eyebrows,
auth-page hints). Portal: signed-out + webmail copy now derive their hosts
from runtime config (new public.mailUrl, NUXT_PUBLIC_MAIL_URL in prod).

infrastructure/production/fleet/apps/portal.yaml

@@ -39,6 +39,8 @@ spec:
               value: https://app.dezky.eu
             - name: NUXT_PUBLIC_BOOKING_URL
               value: https://booking.dezky.eu
+            - name: NUXT_PUBLIC_MAIL_URL
+              value: https://mail.dezky.eu
             # Cluster-internal address of platform-api for the nitro proxy.
             - name: PLATFORM_API_INTERNAL_URL
               value: http://platform-api.dezky-apps.svc.cluster.local:3001