[Fix] OpenRouter Connect fails when self-hosted app URL is loopback

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

Related issue

Internal setup OAuth bug report from Slack / task: OpenRouter connect used loopback R_APP_URL for callback_url while self-hosted fleets publish a separate public edge via R_PUBLIC_URL.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

What changed

OpenRouter setup OAuth now prefers R_PUBLIC_URL (falling back to R_APP_URL) for:

• the authorize callback_url sent to OpenRouter
• secure cookie flags tied to that origin
• post-auth/error redirects back into /setup?step=env-vars

The callback URL is built with new URL('/api/openrouter-oauth/callback', publicAppUrl) so a public base that ends in / does not produce a double-slash path (which would miss the PKCE verifier cookie).

A shared getPublicAppUrl() helper matches the existing GitLab/Bitbucket OAuth behavior, and route tests cover public URL set vs unset (including trailing-slash bases).

Self-hosted admins who click Connect OpenRouter on the public edge no longer have OpenRouter send them to a loopback redirect URI.

How it was tested

• Added unit tests for getPublicAppUrl
• Added initiate/callback route tests mirroring GitLab OAuth public-URL coverage (preferred public origin, fallback, secure cookies, error redirects, trailing-slash public URL)
• Existing get-callback-host tests still pass after reusing the helper
• Ran targeted Vitest for the OpenRouter initiate route and pre-push hooks (oxlint, residual lint, check-types:fast, knip)

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

[roomote-roomote]

No new code issues found. See task

• apps/web/src/app/api/openrouter-oauth/initiate/route.ts:49 Build the callback URL without string concatenation. R_PUBLIC_URL accepts valid URLs ending in /, which currently produces //api/openrouter-oauth/callback; that path does not match the verifier cookie's /api/openrouter-oauth path, so the callback arrives without the PKCE verifier. Using new URL('/api/openrouter-oauth/callback', publicAppUrl) (or normalizing the base URL) avoids the breakage.

_{Reviewed 81cd3aa}

[roomote-roomote]

Fixed the callback URL construction.

• Build the OpenRouter callback with new URL('/api/openrouter-oauth/callback', publicAppUrl) so a trailing slash on R_PUBLIC_URL no longer produces //api/... and drops the PKCE verifier cookie path match.
• Added a route regression test covering trailing-slash public bases.

Commit: 81cd3aa