fix(storage): emit origin-relative object URLs

Build signed object URLs as path-only (/api/objects/...) instead of
prefixing APP_BASE_URL, so media loads from whatever host or reverse
proxy served the app. Remove the now-unused base URL from the signer and
drop the APP_BASE_URL / Server.BaseURL config.

.env.example

@@ -41,7 +41,6 @@ JWT_REFRESH_TTL=720h
 
 # Server
 HTTP_ADDR=:8080
-APP_BASE_URL=http://localhost:8080
 
 # SSE
 SSE_HEARTBEAT_INTERVAL=25s