fix: use window.location.origin for auth redirect URL

The build-time env var NEXT_PUBLIC_APP_URL was baking in the wrong URL
for magic link redirects. Using window.location.origin ensures the
redirect always matches the domain the user is currently on.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/(auth)/login/page.tsx

@@ -24,7 +24,7 @@ export default function LoginPage() {
       const { error } = await supabase.auth.signInWithOtp({
         email,
         options: {
-          emailRedirectTo: `${process.env.NEXT_PUBLIC_APP_URL || window.location.origin}/auth/callback`,
+          emailRedirectTo: `${window.location.origin}/auth/callback`,
         },
       })