fix(deploy): read backend base URL at runtime on the server
NEXT_PUBLIC_API_BASE_URL is inlined at build time; the Docker image was baked with the "/api" fallback, so server-side fetches used a relative URL and threw Invalid URL (500 on /api/auth/session). Server code now prefers API_BASE_URL_INTERNAL, injected via the k8s Deployment.