refactor(config): rename GENIUSRUN_PUBLIC_BASE_URL to GENIUSRUN_BACKEND_URL

Now that GENIUSRUN_FRONTEND_URL exists as a separate config value, keeping
the backend's own origin named "PublicBaseURL" invited exactly the kind of
mixup that caused the OIDC callback 404 in the first place. Renamed
consistently: env var, Config.BackendURL, api.SessionConfig.BackendURL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/internal/api/api_test.go

@@ -24,11 +24,11 @@ import (
 func newCtx() context.Context { return context.Background() }
 
 var testSessionConfig = SessionConfig{
-	Secret:        []byte("test-session-secret-at-least-32-bytes-long"),
-	Duration:      time.Hour,
-	Secure:        false,
-	PublicBaseURL: "https://geniusrun.example.com",
-	FrontendURL:   "https://app.geniusrun.example.com",
+	Secret:      []byte("test-session-secret-at-least-32-bytes-long"),
+	Duration:    time.Hour,
+	Secure:      false,
+	BackendURL:  "https://geniusrun.example.com",
+	FrontendURL: "https://app.geniusrun.example.com",
 }
 
 func newTestServer(t *testing.T) (*Server, *store.DB, int64) {

backend/internal/api/session.go

@@ -15,15 +15,15 @@ type SessionConfig struct {
 	Secret   []byte
 	Duration time.Duration
 	Secure   bool
-	// PublicBaseURL is this app's own externally reachable origin (e.g.
+	// BackendURL is this app's own externally reachable origin (e.g.
 	// "https://geniusrun.example.com", no trailing slash), used to build an
 	// absolute post_logout_redirect_uri for the identity provider -- some
 	// providers, including Keycloak, require this to be an absolute URL
 	// matching one registered on the client, not a bare relative path.
-	PublicBaseURL string
+	BackendURL string
 	// FrontendURL is the origin the browser should land on after the OIDC
 	// callback (success or failure) -- see config.Config.FrontendURL for why
-	// this can differ from PublicBaseURL in a split-origin deployment.
+	// this can differ from BackendURL in a split-origin deployment.
 	FrontendURL string
 }
 
@@ -87,7 +87,7 @@ func (s *Server) handleSessionCallback(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleSessionLogout(w http.ResponseWriter, r *http.Request) {
 	http.SetCookie(w, auth.ClearCookie(auth.SessionCookieName, s.Session.Secure))
-	http.Redirect(w, r, s.Auth.EndSessionURL(s.Session.PublicBaseURL+"/"), http.StatusFound)
+	http.Redirect(w, r, s.Auth.EndSessionURL(s.Session.BackendURL+"/"), http.StatusFound)
 }
 
 func (s *Server) handleSessionMe(w http.ResponseWriter, r *http.Request) {