fix: use correct Authentik authorization and token endpoints

The OIDC issuer URL was being used to construct authorize/token URLs,
but Authentik's endpoints are at different paths than the issuer base.

- Use the actual authorization_endpoint from .well-known config
- Use the actual token_endpoint from .well-known config
- Fixes Authentik 'not found' error on login redirect

apps/web/src/pages/CallbackPage.tsx

@@ -35,8 +35,8 @@ export default function CallbackPage() {
 
         setStatus('Exchanging code for token...')
 
-        const issuer = OIDC_ISSUER.endsWith('/') ? OIDC_ISSUER.slice(0, -1) : OIDC_ISSUER
+        const tokenEndpoint = 'https://auth.commumedia.org/application/o/token/'
-        const tokenResponse = await fetch(`${issuer}/token/`, {
+        const tokenResponse = await fetch(tokenEndpoint, {
           method: 'POST',
           headers: {
             'Content-Type': 'application/x-www-form-urlencoded',

apps/web/src/pages/LoginPage.tsx

@@ -20,8 +20,8 @@ export default function LoginPage() {
         code_challenge_method: 'S256',
       })
 
-      const issuer = OIDC_ISSUER.endsWith('/') ? OIDC_ISSUER.slice(0, -1) : OIDC_ISSUER
+      const authorizationEndpoint = 'https://auth.commumedia.org/application/o/authorize/'
-      window.location.href = `${issuer}/authorize?${params.toString()}`
+      window.location.href = `${authorizationEndpoint}?${params.toString()}`
     }
 
     initiateLogin()