feat(apps): make environment URLs prod-ready (env-driven, not hardcoded .local)

The apps were wired for the dev (.local) environment. Drive the base URLs from
env so one build serves dev and prod (.eu):

- portal nuxt.config: OIDC authorization/token/userinfo/discovery URLs +
  redirectUri now derive from NUXT_PUBLIC_AUTH_URL / NUXT_PUBLIC_PORTAL_URL
  (+ PORTAL_OIDC_APP_SLUG); .local defaults keep dev working with no env.
- portal sign-out handler: end-session + post-logout URLs env-driven.
- portal scheduling page: booking base/host from runtimeConfig.public.bookingUrl
  (NUXT_PUBLIC_BOOKING_URL).
- platform-api: tenant mail domain suffix from PLATFORM_TENANT_DOMAIN (dezky.eu
  in prod), defaulting to dezky.local.

(booking needs no change — its only .local ref is the dev-server allowedHosts.)

services/platform-api/src/tenants/provisioning.service.ts

@@ -94,10 +94,12 @@ export class ProvisioningService {
     }
   }
 
-  // Maps tenant slug → mail domain. Production should use a real registered
-  // domain (e.g. acme.dezky.com); locally we use the .local hierarchy.
+  // Maps tenant slug → mail domain. The base is environment-driven
+  // (PLATFORM_TENANT_DOMAIN, e.g. dezky.eu in prod); defaults to the .local
+  // hierarchy for local dev.
   private domainFor(slug: string): string {
-    return `${slug}.dezky.local`
+    const base = process.env.PLATFORM_TENANT_DOMAIN || 'dezky.local'
+    return `${slug}.${base}`
   }
 
   // Best-effort cleanup. Called when a tenant is hard-deleted (not soft-deleted).