fix: use APP_URL for email links instead of host:port

DUMPSTER_PORT=8080 (internal) was baked into email reset links,
producing http://dumpster.dustin.coffee:8080/reset-password which
doesn't resolve through Caddy. Added Config.AppURL() that reads
APP_URL env var (set to https://dumpster.dustin.coffee on server),
falls back to http://host:port for dev.

internal/auth/email_handlers.go

@@ -39,10 +39,7 @@ func (h *Handler) RequestVerification(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	appURL := "http://" + h.cfg.Host
-	if h.cfg.Port != "80" && h.cfg.Port != "443" {
-		appURL += ":" + h.cfg.Port
-	}
+	appURL := h.cfg.AppURL()
 
 	if err := h.mailer.SendVerificationEmail(user.Email, user.Username, token, appURL); err != nil {
 		http.Error(w, `{"error":"failed to send email"}`, http.StatusInternalServerError)
@@ -112,10 +109,7 @@ func (h *Handler) RequestPasswordReset(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	appURL := "http://" + h.cfg.Host
-	if h.cfg.Port != "80" && h.cfg.Port != "443" {
-		appURL += ":" + h.cfg.Port
-	}
+	appURL := h.cfg.AppURL()
 
 	h.mailer.SendPasswordResetEmail(req.Email, username, token, appURL)
 	w.WriteHeader(http.StatusNoContent)