fix(web-app-semaphore): strip base-URL trailing slash for OIDC callback

lookup('tls', ..., 'url.base') always ends with '/', so the OIDC redirect_url and SEMAPHORE_WEB_ROOT contained a double slash (...example//api/...). The '//api/...' callback path did not match the oauthstate cookie's default path '/api/auth/oidc/keycloak', so Semaphore reported 'http: named cookie not present' and bounced OIDC logins back to /auth/login. Apply regex_replace('/+$', '') (same idiom as web-app-keycloak) to both values; Keycloak's redirect URIs use a '/*' wildcard so the single-slash callback still matches.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

roles/web-app-semaphore/templates/env.j2

@@ -1,7 +1,7 @@
 TZ={{ HOST_TIMEZONE }}
 
 SEMAPHORE_PORT=:{{ container_port }}
-SEMAPHORE_WEB_ROOT={{ lookup('tls', application_id, 'url.base') }}
+SEMAPHORE_WEB_ROOT={{ lookup('tls', application_id, 'url.base') | regex_replace('/+$', '') }}
 
 # Database (central PostgreSQL — Decision #3)
 SEMAPHORE_DB_DIALECT=postgres

roles/web-app-semaphore/vars/main.yml

@@ -45,7 +45,7 @@ SEMAPHORE_OIDC_PROVIDERS_JSON: >-
          "provider_url":   OIDC.CLIENT.ISSUER_URL,
          "client_id":      OIDC.CLIENT.ID,
          "client_secret":  OIDC.CLIENT.SECRET,
-         "redirect_url":   lookup('tls', application_id, 'url.base') ~ "/api/auth/oidc/keycloak/redirect",
+         "redirect_url":   (lookup('tls', application_id, 'url.base') | regex_replace('/+$', '')) ~ "/api/auth/oidc/keycloak/redirect",
          "username_claim": "preferred_username",
          "email_claim":    "email",
          "name_claim":     "name",