Introduces src/lib/site-url.ts with getSiteUrl(), getSiteUrlFromRequest(),
and getSiteHostname() helpers that cascade through NEXT_PUBLIC_SITE_URL,
AUTH_URL, VERCEL_URL, and localhost so no code path ever falls back to a
third-party domain we may not own.
- forgot-password route now derives the base URL from the incoming request
origin so reset links always match the host the user hit
- email-sender, layout metadata, email preview, and QR code routes use the
new helper; email footers display the derived hostname instead of a
hardcoded brand string
- .env.example clarifies the real expected values for AUTH_URL and
NEXT_PUBLIC_SITE_URL per environment
Made-with: Cursor
4431778c0a