fix(storage): emit origin-relative object URLs

Build signed object URLs as path-only (/api/objects/...) instead of
prefixing APP_BASE_URL, so media loads from whatever host or reverse
proxy served the app. Remove the now-unused base URL from the signer and
drop the APP_BASE_URL / Server.BaseURL config.

backend/internal/storage/signer_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http/httptest"
 	"net/url"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 )
@@ -23,7 +24,7 @@ func expiryOf(t *testing.T, raw string) int64 {
 }
 
 func TestSignerURLStableWithinWindow(t *testing.T) {
-	s, err := NewSigner("http://app.test", "secret", time.Hour, time.Hour)
+	s, err := NewSigner("secret", time.Hour, time.Hour)
 	if err != nil {
 		t.Fatalf("new signer: %v", err)
 	}
@@ -35,7 +36,7 @@ func TestSignerURLStableWithinWindow(t *testing.T) {
 }
 
 func TestSignerURLChangesAcrossWindow(t *testing.T) {
-	s, err := NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
+	s, err := NewSigner("secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Fatalf("new signer: %v", err)
 	}
@@ -50,7 +51,7 @@ func TestSignerURLChangesAcrossWindow(t *testing.T) {
 }
 
 func TestSignerURLVerifies(t *testing.T) {
-	s, err := NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
+	s, err := NewSigner("secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Fatalf("new signer: %v", err)
 	}
@@ -61,3 +62,21 @@ func TestSignerURLVerifies(t *testing.T) {
 		t.Fatalf("verify issued URL: %v", err)
 	}
 }
+
+func TestSignerURLIsOriginRelative(t *testing.T) {
+	s, err := NewSigner("secret", time.Hour, 10*time.Minute)
+	if err != nil {
+		t.Fatalf("new signer: %v", err)
+	}
+	raw := s.URL("objects/a/thumb.webp")
+	u, err := url.Parse(raw)
+	if err != nil {
+		t.Fatalf("parse url: %v", err)
+	}
+	if u.Scheme != "" || u.Host != "" || u.IsAbs() {
+		t.Fatalf("url is not origin-relative: %q", raw)
+	}
+	if !strings.HasPrefix(raw, "/api/objects/") {
+		t.Fatalf("url = %q, want /api/objects/ prefix", raw)
+	}
+}