Point auth references at charon.sticknife.com

auth.sticknife.com moved to charon.sticknife.com. Rather than swapping the
hostname in each place, derive the OIDC issuer and the logout fallback from
AUTH_BASE_URL so the auth host is configured in one place.

Backend routes using charon.potternet.lan are unchanged; that internal name
remains the preferred route.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/templates/landing.html

@@ -73,7 +73,7 @@
     <div class="sn-baseline"></div>
     <div class="sn-colophon">
       <span>sticknife.com</span>
-      <span>accounts and keys &mdash; auth.sticknife.com</span>
+      <span>accounts and keys &mdash; charon.sticknife.com</span>
     </div>
   </footer>
 </div>

app/templates/pantheon/charon.toml

@@ -7,7 +7,7 @@ name   = "Charon"
 domain = "The Ferryman"
 state  = "here"
 label  = "Live"
-host   = "auth.sticknife.com"
+host   = "charon.sticknife.com"
 runs   = "Authentik + FreeIPA"
 
 # one line, used by the no-JavaScript listing