fix(storage): emit origin-relative object URLs

Build signed object URLs as path-only (/api/objects/...) instead of
prefixing APP_BASE_URL, so media loads from whatever host or reverse
proxy served the app. Remove the now-unused base URL from the signer and
drop the APP_BASE_URL / Server.BaseURL config.

backend/internal/storage/storage.go

@@ -111,7 +111,7 @@ func Open(ctx context.Context, cfg *config.Config, jwtSecret string) (Backend, e
 	if secret == "" {
 		return nil, errors.New("object URL secret is not available")
 	}
-	signer, err := NewSigner(cfg.Server.BaseURL, secret, cfg.Storage.URLTTL, cfg.Storage.URLSignWindow)
+	signer, err := NewSigner(secret, cfg.Storage.URLTTL, cfg.Storage.URLSignWindow)
 	if err != nil {
 		return nil, err
 	}