fix(headless-login): honor public base url for audience checks

- resolve headless audience against BACKEND_PUBLIC_URL first
- keep forwarded header support for https absolute audiences
- add regression tests for https success and http mismatch rejection
- write BACKEND_PUBLIC_URL into staging workflow env generation

.gitea/workflows/staging_code_pull.yml

@@ -91,6 +91,7 @@ jobs:
                   USERFRONT_URL=${{ vars.USERFRONT_URL }}
                   ADMINFRONT_URL=${{ vars.ADMINFRONT_URL }}
                   DEVFRONT_URL=${{ vars.DEVFRONT_URL }}
+                  BACKEND_PUBLIC_URL=${{ vars.BACKEND_URL }}
                   BACKEND_URL=${{ vars.BACKEND_URL }}
                   OATHKEEPER_PUBLIC_URL=${{ vars.OATHKEEPER_PUBLIC_URL }}
                   ORY_POSTGRES_TAG=${{ vars.ORY_POSTGRES_TAG }}

.gitea/workflows/staging_release.yml

@@ -98,6 +98,7 @@ jobs:
           ADMIN_EMAIL=${{ vars.ADMIN_EMAIL }}
           ADMIN_PASSWORD=${{ secrets.STG_ADMIN_PASSWORD }}
           USERFRONT_URL=${{ vars.USERFRONT_URL }}
+          BACKEND_PUBLIC_URL=${{ vars.BACKEND_URL }}
           BACKEND_URL=${{ vars.BACKEND_URL }}
           OATHKEEPER_PUBLIC_URL=${{ vars.OATHKEEPER_PUBLIC_URL }}
           ORY_POSTGRES_TAG=${{ vars.ORY_POSTGRES_TAG }}