refactor(federation): extract getOurOrigin() into shared federationAuth export

Consolidates 4 inline constructions of the instance origin URL into a
single shared function. Removes the private copy in federationWorker
and two ad-hoc domainOrigin variables in federationOutbox.

packages/server/src/utils/federationAuth.ts

@@ -1,4 +1,5 @@
 import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { config } from '../config.js';
 
 const DEFAULT_MAX_AGE_MS = 15 * 60 * 1000; // 15 minutes
 
@@ -122,3 +123,14 @@ export function parseFederationHeaders(
 
   return { origin, timestamp: timestampMs, signature };
 }
+
+/**
+ * Return the canonical origin URL for this instance.
+ * Uses DOMAIN env var for production, falls back to localhost for dev.
+ */
+export function getOurOrigin(): string {
+  if (config.domain) {
+    return `https://${config.domain}`;
+  }
+  return `http://localhost:${config.port}`;
+}