fix(confidence-engine): preserve external auth callback origin

app/auth/callback/route.js

@@ -4,7 +4,22 @@ import { NextResponse } from "next/server";
 export async function GET(request) {
   const requestUrl = new URL(request.url);
   const code = requestUrl.searchParams.get("code");
-  const response = NextResponse.redirect(new URL("/", requestUrl.origin));
+
+  // Derive redirect origin from proxy-forwarded headers when present,
+  // falling back to the direct request origin for local/direct access.
+  const forwardedHost = request.headers.get("x-forwarded-host");
+  const forwardedProto = request.headers.get("x-forwarded-proto");
+  let origin;
+
+  if (forwardedHost && forwardedProto) {
+    // Nginx Proxy Manager (and similar proxies) set these headers.
+    // x-forwarded-host may contain host:port or just hostname; use as-is.
+    origin = `${forwardedProto}://${forwardedHost}`;
+  } else {
+    origin = requestUrl.origin;
+  }
+
+  const response = NextResponse.redirect(new URL("/", origin));
 
   if (code) {
     const supabase = createServerClient(