fix(pwa): return the caller's own host in the CLI device-flow URLs

[ralyodio]

logicsrc login --device printed this, even on the real domain:

🔑 Authorize the LogicSRC CLI from any browser:
   1. open https://logicsrc-credentials-production.up.railway.app/cli/device
   2. enter the code: 83HN-5QSM

Root cause

The URL never came from the CLI. The CLI just prints what the server sends:

// packages/cli/src/teams.ts:141
console.error(`   1. open ${start.verification_uri}`);

And the server built it from a single fixed value:

// apps/pwa/src/routes/cli.mjs:133
verification_uri: `${config.origin}/cli/device`
// apps/pwa/src/config.mjs:26
const origin = process.env.PUBLIC_ORIGIN || `http://localhost:${PORT}`;

$PUBLIC_ORIGIN names exactly one hostname, so the response is wrong for every
other host the app answers on. (This is also why #104 — which changed the CLI's
DEFAULT_API_URL — had no effect on the printed URL: wrong layer.)

Fix

Derive the origin from the request, so whatever host the CLI called is the host it
gets sent back to. trust proxy is already set in server.mjs, so
X-Forwarded-Proto/X-Forwarded-Host are honoured behind Railway's TLS terminator.

Scoped to the two device-flow URLs on purpose. expectedOrigin in passkey.mjs
stays pinned to config.origin — validating a WebAuthn signature against a
caller-supplied host would defeat the check.

Tests

New apps/pwa/test/origin.test.mjs, 5 cases, all passing — including that the
Railway hostname still self-describes correctly when that is the host, so this
follows the request rather than swapping one hardcode for another.

Still required separately

This fixes which URL is printed. The link only loads once that host routes to
this service — currently logicsrc.com/cli/device returns 404.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.