fix(auth): pass Auth.js variables to the container and fix redirect origins

[kunjhirapara]

Three faults, all found from one screenshot of a failed Google sign-in on production. Sign-in could not have worked with any of them present.

1. The container never received the Auth.js variables

docker-compose.yml passed no AUTH_* variable to the app service. Compose gives a container nothing that isn't named in its environment: block, so setting them in the VM's .env would have changed nothing — and would have looked like the values were wrong rather than absent.

This is the one that made the outage unfixable from the operator's side. All nine are now passed, with the AUTH_ADAPTER_SECRET note about it needing to match the Convex deployment.

2. Redirects went to https://0.0.0.0:3000

Auth.js builds redirect and error URLs from the request origin. The Dockerfile sets HOSTNAME=0.0.0.0, and the VM's nginx does not forward the Host header, so that origin resolved to the container's bind address. Every failed sign-in sent the browser to https://0.0.0.0:3000/signin?error=Configuration and died on ERR_ADDRESS_INVALID — so the one page that could have explained the failure was the one page the user could not reach.

The runner stage now defaults AUTH_URL from the NEXT_PUBLIC_APP_URL build arg. No new variable to set, no proxy cooperation required — the fix docs/HANDOFF.md already prefers over relying on proxy_set_header Host $host. Compose can still override it.

3. ?error= rendered as nothing

pages.error points at /signin, so a failed OAuth round trip comes back with a code and no other signal — and the page looked exactly like a fresh visit. Indistinguishable from the button being broken.

Codes now map to sentences. Two matter:

• Configuration says the fault is ours and marks itself non-retryable, because telling someone to try again against a misconfigured server is a loop that cannot succeed. The provider buttons and submit are disabled for it.
• AccessDenied is what our own signIn callback returns when it refuses to link an OAuth identity to an existing account. It explains the way forward rather than reading as a generic failure.

Unknown codes fall back rather than printing a raw code at a user.

Verification

• 263/263 tests pass (13 new), tsc --noEmit clean, production build green.
• docker-compose.yml and the workflow YAML both parse.

Deploying this

Still needs the values themselves set in the VM's .env — this PR makes them reach the app, it does not invent them. AUTH_ADAPTER_SECRET must additionally be set on Convex with npx convex env set AUTH_ADAPTER_SECRET <same value> --prod, and the OAuth redirect URIs registered: /api/auth/callback/google, /api/auth/callback/github.

After this image rolls out, /.well-known/jwks.json returning a key instead of 503 and /api/health reporting "auth": true are the two quickest confirmations.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.