Expose PocketBase URL to client-side for OIDC auth

POCKETBASE_URL was only available server-side, causing the login page
to fall back to localhost:8090 in the browser. Renamed to
NEXT_PUBLIC_POCKETBASE_URL so Next.js bundles it into client code.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

spec.md

@@ -645,7 +645,7 @@ APP_URL=https://phaseflow.yourdomain.com
 NODE_ENV=production
 
 # PocketBase
-POCKETBASE_URL=http://localhost:8090
+NEXT_PUBLIC_POCKETBASE_URL=http://localhost:8090
 
 # Email (Resend)
 RESEND_API_KEY=xxx
@@ -700,7 +700,7 @@ job "phaseflow" {
         data = <<EOF
 {{ with nomadVar "nomad/jobs/phaseflow" }}
 APP_URL={{ .app_url }}
-POCKETBASE_URL={{ .pocketbase_url }}
+NEXT_PUBLIC_POCKETBASE_URL={{ .pocketbase_url }}
 RESEND_API_KEY={{ .resend_key }}
 ENCRYPTION_KEY={{ .encryption_key }}
 CRON_SECRET={{ .cron_secret }}