feat(install): ask for the public URL, wire it into .env

install.sh now asks one question on fresh installs — the URL the app is
opened on. Accepts https://primora.example.com (TLS at the user's proxy),
primora.example.com, or 192.168.1.50:8085; the port becomes NGINX_PORT.
The answer rewrites every public URL var and COOKIE_DOMAIN for real DNS
names. PUBLIC_URL env keeps it non-interactive; legacy DOMAIN/NGINX_PORT
still work; reruns over an existing .env skip the question and display
the URL from the file.

Also trust both URL schemes on the serving host in trustedOrigins —
external TLS termination makes nginx report http while browsers arrive
over https.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/auth/src/lib/auth.ts

@@ -63,6 +63,9 @@ export const auth = betterAuth({
     if (host) {
       const proto = request?.headers.get("x-forwarded-proto") ?? "http";
       origins.push(`${proto}://${host}`);
+      // TLS often terminates at an external proxy — nginx then reports http.
+      // Both schemes on the serving host are legitimately this instance.
+      origins.push(proto === "https" ? `http://${host}` : `https://${host}`);
     }
     return origins;
   },