fix(auth): route server-side Supabase calls via internal URL to avoid edge rate-limit

Server-side Supabase calls (middleware getUser/refresh, server components,
admin client) all egress through the Docker gateway as a single NATed IP and
traverse Caddy's per-IP /auth/* rate limiter (8 events/s). A handful of active
users saturate that shared bucket, 429ing getUser()/token refresh; the
middleware then treats the session as invalid and bounces to /login, while a
manual refresh lands under budget and works again.

Add SUPABASE_INTERNAL_URL (e.g. http://kong-prod:8000) used only by the
server-side clients (middleware, lib/supabase/server.ts, admin getSupabaseAdmin
/getSupabaseAnon), falling back to the public URL when unset. Browser clients
keep the public URL so real per-user-IP edge rate limiting still applies.

Also bake the arg in the Dockerfile/build and make the web-prod network alias
durable via WEB_ALIAS (dev sets web-dev) so the dev container can't reclaim the
web-prod alias on redeploy.

Dockerfile

@@ -15,9 +15,14 @@ COPY . .
 ARG NEXT_PUBLIC_SUPABASE_URL
 ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
 ARG NEXT_PUBLIC_APP_URL
+# Server-only internal Supabase URL (e.g. http://kong-prod:8000). Provided at
+# build time so Next inlines it into the Edge middleware bundle; also read at
+# runtime by the Node server components. Optional — falls back to the public URL.
+ARG SUPABASE_INTERNAL_URL
 ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL \
     NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY \
-    NEXT_PUBLIC_APP_URL=$NEXT_PUBLIC_APP_URL
+    NEXT_PUBLIC_APP_URL=$NEXT_PUBLIC_APP_URL \
+    SUPABASE_INTERNAL_URL=$SUPABASE_INTERNAL_URL
 RUN npm run build
 
 FROM node:24.16.0-alpine AS runner