fix(storage): emit origin-relative object URLs

Build signed object URLs as path-only (/api/objects/...) instead of
prefixing APP_BASE_URL, so media loads from whatever host or reverse
proxy served the app. Remove the now-unused base URL from the signer and
drop the APP_BASE_URL / Server.BaseURL config.

backend/internal/app/health_test.go

@@ -18,7 +18,7 @@ import (
 
 func mustSigner(t *testing.T) *storage.Signer {
 	t.Helper()
-	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
+	signer, err := storage.NewSigner("secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Fatalf("signer: %v", err)
 	}

backend/internal/app/objects_test.go

@@ -22,7 +22,7 @@ import (
 func newTestServerWithFS(t *testing.T) (*storage.FS, *gin.Engine) {
 	t.Helper()
 	gin.SetMode(gin.TestMode)
-	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
+	signer, err := storage.NewSigner("secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Fatalf("signer: %v", err)
 	}

backend/internal/app/share_flow_test.go

@@ -149,7 +149,7 @@ func runShareFlow(t *testing.T, backend storage.Backend, verify func(t *testing.
 }
 
 func TestShareFlowWithFS(t *testing.T) {
-	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
+	signer, err := storage.NewSigner("secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Fatalf("signer: %v", err)
 	}
@@ -178,7 +178,7 @@ func TestShareFlowWithS3(t *testing.T) {
 	if endpoint == "" {
 		t.Skip("S3_ENDPOINT not set")
 	}
-	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
+	signer, err := storage.NewSigner("secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Skipf("signer init: %v", err)
 	}