fix(api): redirect the OIDC callback to FrontendURL, not a relative path

handleSessionCallback's redirects (success and all 4 failure branches)
were relative paths, which resolve against the backend's own origin --
broken in this project's own supported split-origin local dev setup,
since the Go backend serves no "/" route at all. Now uses the new
config.Config.FrontendURL (defaults to PublicBaseURL, so no change for
single-origin production deployments).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/cmd/geniusrund/main.go

@@ -52,6 +52,7 @@ func main() {
 		Duration:      cfg.SessionDuration,
 		Secure:        cfg.SessionSecure,
 		PublicBaseURL: cfg.PublicBaseURL,
+		FrontendURL:   cfg.FrontendURL,
 	})
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)