Point auth references at charon.sticknife.com

auth.sticknife.com moved to charon.sticknife.com. Rather than swapping the
hostname in each place, derive the OIDC issuer and the logout fallback from
AUTH_BASE_URL so the auth host is configured in one place.

Backend routes using charon.potternet.lan are unchanged; that internal name
remains the preferred route.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/templates/pantheon/charon.toml

@@ -7,7 +7,7 @@ name   = "Charon"
 domain = "The Ferryman"
 state  = "here"
 label  = "Live"
-host   = "auth.sticknife.com"
+host   = "charon.sticknife.com"
 runs   = "Authentik + FreeIPA"
 
 # one line, used by the no-JavaScript listing