fix(web-app-semaphore): derive the web root from the canonical domain

lookup('tls', application_id, ...) aligns an app id to the network of the
vhost being rendered, so inside the onion sibling's vhost
SEMAPHORE_WEB_ROOT became the onion URL. The base-href rewrite from
bcb6c9f105 then saw domain == web root host, rendered nothing, and the
onion page kept loading its assets from clearnet. Looking the web root up
by the canonical domain keeps it clearnet everywhere, so the rewrite
applies on every other sibling; env.j2 and the OIDC redirect_url already
rendered the canonical value.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/web-app-semaphore/vars/main.yml

@@ -3,7 +3,7 @@ application_id: "web-app-semaphore"
 container_port: "{{ lookup('config', application_id, 'services.semaphore.ports.internal.http') }}"
 
 SEMAPHORE_NAME: "{{ lookup('config', application_id, 'services.semaphore.name') }}"
-SEMAPHORE_WEB_ROOT: "{{ lookup('tls', application_id, 'url.base') | regex_replace('/+$', '') }}"
+SEMAPHORE_WEB_ROOT: "{{ lookup('tls', lookup('domain', application_id), 'url.base') | regex_replace('/+$', '') }}"
 SEMAPHORE_SIBLING_BASE_REWRITE: >-
   sub_filter '<base href="{{ SEMAPHORE_WEB_ROOT }}/">' '<base href="/">';