fix(auth): скрыть пароли от читателя и согласовать Portal

lib/app-switcher-config.test.ts

@@ -0,0 +1,18 @@
+import assert from 'node:assert/strict'
+import {authPortalBaseUrl} from './app-switcher-config'
+import {ensureAuthConfig} from './auth'
+import {test} from 'node:test'
+test('runtime Portal links override the build address',async()=>{
+const previous=process.env.NEXT_PUBLIC_AUTH_PORTAL_URL,originalFetch=globalThis.fetch
+try{
+  process.env.NEXT_PUBLIC_AUTH_PORTAL_URL='https://build.example/'
+  assert.equal(authPortalBaseUrl(),'https://build.example')
+  globalThis.fetch=async()=>new Response(JSON.stringify({required:true,portal_url:'http://localhost:5175/'}),{headers:{'content-type':'application/json'}})
+  await ensureAuthConfig()
+  assert.equal(authPortalBaseUrl(),'http://localhost:5175','header links and switcher fetch share runtime Portal')
+}finally{
+  globalThis.fetch=originalFetch
+  if(previous===undefined)delete process.env.NEXT_PUBLIC_AUTH_PORTAL_URL;else process.env.NEXT_PUBLIC_AUTH_PORTAL_URL=previous
+}
+console.log('app switcher: runtime Portal overrides build URL; fallback and trailing slash passed')
+})

lib/app-switcher-config.ts

@@ -7,6 +7,7 @@ import {
   type LucideIcon,
 } from "lucide-react"
 import { formatAppVersionLabel, getAppVersion } from "@/lib/app-version"
+import {getAuthConfigSync} from "@/lib/auth"
 
 export const CURRENT_APP_ID = "mm"
 
@@ -150,7 +151,7 @@ export function mergeWithLocalApp(config: AppSwitcherConfig): AppSwitcherConfig
 }
 
 export function authPortalBaseUrl(): string | null {
-  const raw = process.env.NEXT_PUBLIC_AUTH_PORTAL_URL?.trim()
+  const raw = (getAuthConfigSync()?.portalUrl || process.env.NEXT_PUBLIC_AUTH_PORTAL_URL)?.trim()
   if (!raw) return null
   return raw.replace(/\/$/, "")
 }