refactor(config): rename GENIUSRUN_PUBLIC_BASE_URL to GENIUSRUN_BACKEND_URL

Now that GENIUSRUN_FRONTEND_URL exists as a separate config value, keeping
the backend's own origin named "PublicBaseURL" invited exactly the kind of
mixup that caused the OIDC callback 404 in the first place. Renamed
consistently: env var, Config.BackendURL, api.SessionConfig.BackendURL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/cmd/geniusrund/main.go

@@ -48,11 +48,11 @@ func main() {
 	}, appsync.Config{
 		MinConfidence: cfg.MinConfidence,
 	}, authVerifier, api.SessionConfig{
-		Secret:        cfg.SessionSecret,
-		Duration:      cfg.SessionDuration,
-		Secure:        cfg.SessionSecure,
-		PublicBaseURL: cfg.PublicBaseURL,
-		FrontendURL:   cfg.FrontendURL,
+		Secret:      cfg.SessionSecret,
+		Duration:    cfg.SessionDuration,
+		Secure:      cfg.SessionSecure,
+		BackendURL:  cfg.BackendURL,
+		FrontendURL: cfg.FrontendURL,
 	})
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)