feat(apps): make environment URLs prod-ready (env-driven, not hardcoded .local)

The apps were wired for the dev (.local) environment. Drive the base URLs from
env so one build serves dev and prod (.eu):

- portal nuxt.config: OIDC authorization/token/userinfo/discovery URLs +
  redirectUri now derive from NUXT_PUBLIC_AUTH_URL / NUXT_PUBLIC_PORTAL_URL
  (+ PORTAL_OIDC_APP_SLUG); .local defaults keep dev working with no env.
- portal sign-out handler: end-session + post-logout URLs env-driven.
- portal scheduling page: booking base/host from runtimeConfig.public.bookingUrl
  (NUXT_PUBLIC_BOOKING_URL).
- platform-api: tenant mail domain suffix from PLATFORM_TENANT_DOMAIN (dezky.eu
  in prod), defaulting to dezky.local.

(booking needs no change — its only .local ref is the dev-server allowedHosts.)

apps/portal/server/api/auth/sign-out.get.ts

@@ -24,8 +24,14 @@
 
 import { getUserSession, clearUserSession } from 'nuxt-oidc-auth/runtime/server/utils/session.js'
 
-const END_SESSION = 'https://auth.dezky.local/application/o/dezky-portal/end-session/'
-const POST_LOGOUT_REDIRECT = 'https://app.dezky.local/signed-out'
+// Environment-driven so one build serves dev (.local) and prod (.eu). The
+// public runtime config carries authUrl/portalUrl (NUXT_PUBLIC_AUTH_URL /
+// NUXT_PUBLIC_PORTAL_URL); fall back to the dev hosts.
+const AUTH_URL = (process.env.NUXT_PUBLIC_AUTH_URL || 'https://auth.dezky.local').replace(/\/$/, '')
+const PORTAL_URL = (process.env.NUXT_PUBLIC_PORTAL_URL || 'https://app.dezky.local').replace(/\/$/, '')
+const OIDC_APP_SLUG = process.env.PORTAL_OIDC_APP_SLUG || 'dezky-portal'
+const END_SESSION = `${AUTH_URL}/application/o/${OIDC_APP_SLUG}/end-session/`
+const POST_LOGOUT_REDIRECT = `${PORTAL_URL}/signed-out`
 
 export default defineEventHandler(async (event) => {
   const session = await getUserSession(event).catch(() => ({} as any))