fix(logout): use NEXT_PUBLIC_LOGOUT_REDIRECT_URL env, drop hostname regex

[awais786]

Summary

• Logout was deriving the portal host from `window.location.hostname` via regex. Three regexes have shipped across branches; none covers both deployment shapes.
• Build pipeline already passes the right URL via `NEXT_PUBLIC_LOGOUT_REDIRECT_URL`. Read it directly — same image works for any hostname layout the deployer configures.
• If env unset → `console.error` + return `false` instead of redirecting to a broken URL.

Symptom (sandbox)

On `https://research.foss.arbisoft.com\` → logout currently redirects to `https://foss.foss.arbisoft.com/\` (older regex `/^[^.]./, "foss."`) or stays on the same host and re-auths (newer regex `/^[^.]+\.(?=[^.]\.[^.]*\.)/`).

Why regex doesn't cut it

Regex shipped	`foss-research.arbisoft.com` (prod)	`research.foss.arbisoft.com` (sandbox)
`/^[^.]*./, "foss."`	✅ `foss.arbisoft.com`	❌ `foss.foss.arbisoft.com`
`/^([^-]+)-[^.]+\.(.+)/, "$1.$2"`	✅ `foss.arbisoft.com`	❌ unchanged → re-auth loop
`/^[^.]+\.(?=[^.]\.[^.]\.)/, ""`	❌ unchanged → re-auth loop	✅ `foss.arbisoft.com`

The deployer knows the portal URL. The SPA shouldn't try to guess.

Build wiring already exists

`foss-server-bundle-devstack` Makefile `dev.build.surfsense.web`:
```
docker build … --build-arg NEXT_PUBLIC_LOGOUT_REDIRECT_URL="https://$SMB_NAME.$PLATFORM_DOMAIN" …
```
Same arg is in the Dockerfile (`ARG NEXT_PUBLIC_LOGOUT_REDIRECT_URL=` → baked at build time as `process.env.NEXT_PUBLIC_LOGOUT_REDIRECT_URL`).

Test plan

• Build image for sandbox (`SMB_NAME=foss`, `PLATFORM_DOMAIN=arbisoft.com`), confirm logout redirects to `https://foss.arbisoft.com/\`.
• Build image for prod-style host (`PLATFORM_DOMAIN=arbisoft.com`, `SUBDOMAIN_PREFIX=foss-`), confirm logout redirects to `https://foss.arbisoft.com/\`.
• Build image for local devstack (`PLATFORM_DOMAIN=local.moneta.dev`, `SUBDOMAIN_PREFIX=foss-`, `SMB_NAME=foss`), confirm logout redirects to `https://foss.local.moneta.dev/\`.
• Build with arg unset → confirm console.error + no redirect.

Follow-ups (separate PRs, same pattern)

• `Pressingly/plane` `apps/web/core/store/user/index.ts:264` — read `VITE_LOGOUT_REDIRECT_URL`
• `Pressingly/outline` `app/stores/AuthStore.ts:357` — already has `env.OIDC_LOGOUT_URI` infrastructure; restore it
• `Pressingly/penpot` `frontend/src/app/main/data/auth.cljs` — read injected `MPASS_SIGNOUT_URL` global from `config.js`