refactor(config): rename GENIUSRUN_PUBLIC_BASE_URL to GENIUSRUN_BACKEND_URL

Now that GENIUSRUN_FRONTEND_URL exists as a separate config value, keeping
the backend's own origin named "PublicBaseURL" invited exactly the kind of
mixup that caused the OIDC callback 404 in the first place. Renamed
consistently: env var, Config.BackendURL, api.SessionConfig.BackendURL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/internal/api/api_test.go

@@ -24,11 +24,11 @@ import (
 func newCtx() context.Context { return context.Background() }
 
 var testSessionConfig = SessionConfig{
-	Secret:        []byte("test-session-secret-at-least-32-bytes-long"),
-	Duration:      time.Hour,
-	Secure:        false,
-	PublicBaseURL: "https://geniusrun.example.com",
-	FrontendURL:   "https://app.geniusrun.example.com",
+	Secret:      []byte("test-session-secret-at-least-32-bytes-long"),
+	Duration:    time.Hour,
+	Secure:      false,
+	BackendURL:  "https://geniusrun.example.com",
+	FrontendURL: "https://app.geniusrun.example.com",
 }
 
 func newTestServer(t *testing.T) (*Server, *store.DB, int64) {