fix: use APP_URL for email links instead of host:port

DUMPSTER_PORT=8080 (internal) was baked into email reset links,
producing http://dumpster.dustin.coffee:8080/reset-password which
doesn't resolve through Caddy. Added Config.AppURL() that reads
APP_URL env var (set to https://dumpster.dustin.coffee on server),
falls back to http://host:port for dev.

internal/config/config.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"bufio"
+	"fmt"
 	"os"
 	"strconv"
 	"strings"
@@ -151,6 +152,22 @@ func Load() *Config {
 	}
 }
 
+func (c *Config) AppURL() string {
+	if v := getEnv("APP_URL", ""); v != "" {
+		return v
+	}
+	scheme := "http"
+	port := c.Port
+	if c.Database.SSLMode == "require" {
+		// ponytail: using SSLMode as a rough https hint; add explicit APP_URL for real setups
+		scheme = "https"
+	}
+	if port == "80" || port == "443" {
+		return fmt.Sprintf("%s://%s", scheme, c.Host)
+	}
+	return fmt.Sprintf("%s://%s:%s", scheme, c.Host, port)
+}
+
 func (c *Config) DatabaseDSN() string {
 	return "postgres://" + c.Database.User + ":" + c.Database.Password + "@" + c.Database.Host + ":" + c.Database.Port + "/" + c.Database.Database + "?sslmode=" + c.Database.SSLMode
 }