feat(federation): PUBLIC_ORIGIN env override for getOurOrigin

Adds an explicit override for the federation transport URL returned by
getOurOrigin(). When unset, behaviour is unchanged (https://${DOMAIN} ->
http://localhost:${PORT} dev fallback). Intended for reverse-proxy /
dev-without-TLS deployments where the public origin must be advertised
explicitly (typically http://...) and differs from the bare DOMAIN
value used for federated identity.

Wired via config.publicOrigin (envOptional('PUBLIC_ORIGIN')) so the
override flows through the existing config layer rather than scattering
process.env reads. Trailing slash is stripped for symmetry with
peer.origin storage.

docs/systems/federation.md gets a "Public Origin Override" subsection
under §14 Background Workers documenting the resolution order.

packages/server/src/utils/federationAuth.ts

@@ -174,9 +174,21 @@ export function parseFederationHeaders(
 
 /**
  * Return the canonical origin URL for this instance.
- * Uses DOMAIN env var for production, falls back to localhost for dev.
+ *
+ * Resolution order:
+ *   1. `PUBLIC_ORIGIN` env (verbatim, trailing slash stripped) — overrides everything.
+ *      Used by integration test harnesses that bind to 127.0.0.1:<ephemeral> and by
+ *      reverse-proxy / dev-without-TLS setups where federation must advertise an
+ *      explicit origin distinct from the public DOMAIN. The override is the URL
+ *      transport layer; identity (homeInstance) still derives from DOMAIN.
+ *   2. `https://${DOMAIN}` — production default.
+ *   3. `http://localhost:${PORT}` — dev fallback when DOMAIN is unset.
  */
 export function getOurOrigin(): string {
+  const override = config.publicOrigin;
+  if (override && override.trim()) {
+    return override.trim().replace(/\/$/, '');
+  }
   if (config.domain) {
     return `https://${config.domain}`;
   }