🐛 fix(auth): use PORTLESS_URL as redirect origin behind the dev proxy

- Auth routes rebuilt redirects from request.url, which behind the portless
  proxy is the internal localhost:PORT, breaking the OAuth callback with
  ERR_SSL_PROTOCOL_ERROR.
- Use PORTLESS_URL when present; unset in production, so behavior is unchanged.

Author: srizzon

src/app/api/auth/github/route.ts

@@ -3,7 +3,11 @@ import { createServerSupabase } from "@/lib/supabase-server";
 import { isLocalSupabase } from "@/lib/sign-in";
 
 export async function GET(request: Request) {
-  const { searchParams, origin } = new URL(request.url);
+  const url = new URL(request.url);
+  const { searchParams } = url;
+  // Atrás do proxy dev do portless, request.url é o localhost:PORT interno.
+  // PORTLESS_URL é a URL pública https da worktree; em produção não existe.
+  const origin = (process.env.PORTLESS_URL ?? url.origin).replace(/\/$/, "");
   const redirectPath = searchParams.get("redirect") ?? "/";
 
   // Local dev has no GitHub OAuth provider configured — use the dev-login.

src/app/auth/callback/route.ts

@@ -7,7 +7,12 @@ import { provisionDeveloperOnLogin } from "@/lib/auth-provision";
 export const maxDuration = 60;
 
 export async function GET(request: Request) {
-  const { searchParams, origin } = new URL(request.url);
+  const url = new URL(request.url);
+  const { searchParams } = url;
+  // Atrás do proxy dev do portless, request.url é o localhost:PORT interno, então
+  // os redirects cairiam em https://localhost:PORT (SSL error). PORTLESS_URL é a
+  // URL pública https desta worktree; em produção não existe → usa o origin real.
+  const origin = (process.env.PORTLESS_URL ?? url.origin).replace(/\/$/, "");
   const code = searchParams.get("code");
 
   if (!code) {