feat(web): serve the web app under /app and send every billing link there (WS-B)

apps/web was never deployed, so /billing on the public domain returned the
landing page and d3ro.dev (desktop "upgrade") did not resolve.

- apps/web runs with basePath /app and output standalone; /download and
  /releases redirect to the site's #download. A Dockerfile and a d3ro-web
  compose service (port 3002) deploy it to the NAS with the other images.
- The site bridge worker forwards /app/* to WEB_APP_ORIGIN (the tunnel host)
  and rewrites upstream redirects; everything else still goes to Pages.
  With no origin configured /app answers 503 instead of the landing page.
- Desktop upgrade, desktop Stripe return, mobile subscription management,
  the web checkout/portal returns and the site all use billingUrl(); the
  return query is success=1 / canceled=1, which the billing page reads.
  The billing page highlights ?tier=pro|pro_plus, and signing in from a
  billing link returns to the same plan.
- auth/callback pins the redirect origin in production and rejects
  protocol-relative next= values (open redirect).
- Mobile legal links use SITE_URLS (fixes the missing slash on /terms).
- Compose drops the unused NEXT_PUBLIC_API_URL and the dead wwwroot legal
  mounts; deploy scripts add the web image and the SUPABASE_* values the NAS
  compose already required; .dockerignore keeps app .env files out of images.
- Supabase auth redirects allow /app/** (remote dashboard must match).

Policy: docs/REFACTOR_POLICY.md Wave 3, W3-3 and W3-4.

apps/web/src/components/billing/checkout-button.tsx

@@ -6,6 +6,7 @@
 import { useState } from 'react'
 import { Button, CircularProgress, Alert, Box } from '@mui/material'
 import { getSupabaseBrowserClient } from '@/lib/supabase-browser'
+import { browserBillingUrl } from '@/lib/web-app-url'
 import type { PaypleTier } from './payple-client'
 
 interface CheckoutButtonProps {
@@ -46,8 +47,8 @@ export function CheckoutButton({ tier }: CheckoutButtonProps): React.ReactElemen
           body: JSON.stringify({
             tier,
             idempotency_key: `stripe-checkout:${crypto.randomUUID()}`,
-            success_url: `${window.location.origin}/billing?success=1`,
-            cancel_url: `${window.location.origin}/billing?canceled=1`
+            success_url: browserBillingUrl('success'),
+            cancel_url: browserBillingUrl('canceled')
           })
         }
       )

apps/web/src/components/billing/payple-checkout-button.tsx

@@ -4,6 +4,7 @@ import { useCallback, useEffect, useState } from 'react'
 import { Alert, Box, Button, CircularProgress } from '@mui/material'
 import Script from 'next/script'
 import { getSupabaseBrowserClient } from '@/lib/supabase-browser'
+import { browserBillingUrl } from '@/lib/web-app-url'
 import {
   assertSuccessfulCheckoutResponse,
   clearPaypleIdempotencyKey,
@@ -94,7 +95,7 @@ export function PaypleCheckoutButton({ tier, catalogPrice }: PaypleCheckoutButto
         email: session.user.email,
         tier,
         catalogPrice,
-        resultUrl: `${window.location.origin}/billing`,
+        resultUrl: browserBillingUrl(),
         openSdk: (request) => window.PaypleCpayAuthCheck(request),
         chargeBillingKey: async (payerId, result) => {
           const response = await fetch(checkoutEndpoint(), {

apps/web/src/components/billing/portal-button.tsx

@@ -7,6 +7,7 @@ import { useState } from 'react'
 import { Button, CircularProgress, Alert, Box } from '@mui/material'
 import SettingsIcon from '@mui/icons-material/Settings'
 import { getSupabaseBrowserClient } from '@/lib/supabase-browser'
+import { browserBillingUrl } from '@/lib/web-app-url'
 
 export function PortalButton(): React.ReactElement {
   const [busy, setBusy] = useState(false)
@@ -39,7 +40,7 @@ export function PortalButton(): React.ReactElement {
             'Content-Type': 'application/json'
           },
           body: JSON.stringify({
-            return_url: `${window.location.origin}/billing`
+            return_url: browserBillingUrl()
           })
         }
       )