fix(storage): emit origin-relative object URLs

Build signed object URLs as path-only (/api/objects/...) instead of
prefixing APP_BASE_URL, so media loads from whatever host or reverse
proxy served the app. Remove the now-unused base URL from the signer and
drop the APP_BASE_URL / Server.BaseURL config.

openspec/changes/host-agnostic-object-urls/proposal.md

@@ -0,0 +1,41 @@
+# Proposal
+
+## Why
+
+Object URLs are absolute and built from `APP_BASE_URL`, whose default is
+`http://localhost:8080`. On a server reached by any other address the browser is told to
+fetch thumbnails and originals from `localhost`, so no photo or preview loads. This was
+observed on a deployment served from `http://192.168.77.82:8080/` with the default
+config: pages, login and album lists work (relative `/api/...`), but every image URL
+points at the client's own machine.
+
+## What Changes
+
+- Emit same-origin object URLs: the signer returns a path-only URL
+  (`/api/objects/<key>?e=...&s=...`) instead of an absolute one.
+- Remove the base URL from the signer (`Signer`/`NewSigner`) since it is no longer
+  needed; verification is unchanged (it uses the key and query only).
+- **BREAKING** (config): remove `APP_BASE_URL` / `Server.BaseURL`, which after this has
+  no remaining use (SSE and API calls are already relative). Update `.env.example` and
+  the README.
+
+## Capabilities
+
+### New Capabilities
+
+<!-- none -->
+
+### Modified Capabilities
+
+- `storage-backends`: add a requirement that issued object URLs are host-independent
+  (same-origin), so the app works behind any host or reverse proxy without calibrated
+  base-URL configuration.
+
+## Impact
+
+- Backend: `backend/internal/storage/signer.go`, `storage.go`
+  (`Open`/`NewSigner` call), `backend/internal/config/config.go` (`Server.BaseURL`).
+- Docs/config: `.env.example`, `README.md`.
+- Tests: signer/fs/objects/app/e2e call sites of `NewSigner` / `Server.BaseURL`.
+- Frontend: unchanged; relative URLs resolve against the page origin. The `sameOrigin`
+  helper in `PanoViewer` becomes a no-op but harmless.