Point auth references at charon.sticknife.com

auth.sticknife.com moved to charon.sticknife.com. Rather than swapping the
hostname in each place, derive the OIDC issuer and the logout fallback from
AUTH_BASE_URL so the auth host is configured in one place.

Backend routes using charon.potternet.lan are unchanged; that internal name
remains the preferred route.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/oidc.py

@@ -92,6 +92,6 @@ def groups_from_claims(claims: dict[str, Any]) -> set[str]:
 
 def logout_url(config: Config) -> str:
     provider = discover(config)
-    endpoint = provider.end_session_endpoint or "https://auth.sticknife.com/if/session-end/"
+    endpoint = provider.end_session_endpoint or f"{config.auth_base_url}/if/session-end/"
     query = urllib.parse.urlencode({"post_logout_redirect_uri": config.base_url})
     return f"{endpoint}?{query}"