feat(federation): PUBLIC_ORIGIN env override for getOurOrigin

Adds an explicit override for the federation transport URL returned by
getOurOrigin(). When unset, behaviour is unchanged (https://${DOMAIN} ->
http://localhost:${PORT} dev fallback). Intended for reverse-proxy /
dev-without-TLS deployments where the public origin must be advertised
explicitly (typically http://...) and differs from the bare DOMAIN
value used for federated identity.

Wired via config.publicOrigin (envOptional('PUBLIC_ORIGIN')) so the
override flows through the existing config layer rather than scattering
process.env reads. Trailing slash is stripped for symmetry with
peer.origin storage.

docs/systems/federation.md gets a "Public Origin Override" subsection
under §14 Background Workers documenting the resolution order.

packages/server/src/config.ts

@@ -34,12 +34,27 @@ function envBool(key: string, defaultValue: boolean): boolean {
   return value === 'true' || value === '1';
 }
 
+// PUBLIC_ORIGIN overrides the federation transport URL returned by getOurOrigin().
+// Used by integration test harnesses that bind to 127.0.0.1:<ephemeral> and by
+// reverse-proxy setups where federation must advertise an http:// origin (the
+// proxy terminates TLS upstream). When unset, getOurOrigin() falls back to
+// https://${DOMAIN} for production safety.
+const publicOrigin = envOptional('PUBLIC_ORIGIN');
+if (publicOrigin !== undefined) {
+  if (!/^https?:\/\//i.test(publicOrigin)) {
+    throw new Error(
+      `PUBLIC_ORIGIN must start with http:// or https:// — got: ${publicOrigin}`
+    );
+  }
+}
+
 export const config = {
   port: envInt('PORT', 3000),
   host: env('HOST', '0.0.0.0'),
   jwtSecret: env('JWT_SECRET'),
   jwtExpiresIn: env('JWT_EXPIRES_IN', '30d'),
   domain: envOptional('DOMAIN'),
+  publicOrigin,
 
   livekit: {
     url: envOptional('LIVEKIT_URL'),