fix(web-app-fider): pass BASE_URL without a trailing slash

Fider v0.39.0 accepts an OAuth redirect only when its origin equals
OAuthBaseURL (isKnownOAuthOrigin compares u.Scheme + "://" + u.Host with
it), and in single-host mode OAuthBaseURL is BASE_URL unchanged; env.go
only url.Parse()s it. The tls lookup's url.base ends with "/", so the
comparison never matched and the OIDC login was rejected (fork run
41926377524, Fider#0, compose tor: Playwright login failure, rescue
artifact fider0-rescue). url.origin is the same URL without the slash.

Fider is deployed on no production host; the change only touches its env.
Committed below the 90/5 bar on the operator's explicit word.

🎯 Fix: 88 %
💥 Break: 4 %
🌱 Efficiency: –
⚡ Speed: –
🛡️ Security: ~100 %
🏆 Score: 84
🚦 Gate: ⛔ fix 88 % < 90 (operator approved)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/web-app-fider/templates/env.j2

@@ -1,6 +1,6 @@
 {% include 'roles/sys-svc-container/templates/env.j2' %}
 
-BASE_URL={{ lookup('tls', application_id, 'url.base') }}
+BASE_URL={{ lookup('tls', application_id, 'url.origin') }}
 DATABASE_URL=postgresql://{{ lookup('database', application_id, 'username') }}:{{ lookup('database', application_id, 'password') }}@{{ lookup('database', application_id, 'host') }}:{{ lookup('database', application_id, 'port') }}/{{ lookup('database', application_id, 'name') }}?sslmode=disable
 JWT_SECRET={{ lookup('config', application_id, 'secrets.credentials.jwt_secret') | dotenv_quote }}