Expose PocketBase URL to client-side for OIDC auth

POCKETBASE_URL was only available server-side, causing the login page
to fall back to localhost:8090 in the browser. Renamed to
NEXT_PUBLIC_POCKETBASE_URL so Next.js bundles it into client code.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

specs/authentication.md

@@ -9,7 +9,7 @@ When I access PhaseFlow, I want to securely log in with my identity provider, so
 Using PocketBase for authentication and data storage, with OIDC (Pocket-ID) as the primary identity provider.
 
 **Connection:**
-- `POCKETBASE_URL` environment variable
+- `NEXT_PUBLIC_POCKETBASE_URL` environment variable
 - `src/lib/pocketbase.ts` initializes client
 
 ## Login Flow
@@ -73,7 +73,7 @@ All routes except `/login` require authentication.
 
 API routes access current user via:
 ```typescript
-const pb = new PocketBase(process.env.POCKETBASE_URL);
+const pb = new PocketBase(process.env.NEXT_PUBLIC_POCKETBASE_URL);
 // Auth token from request cookies
 const user = pb.authStore.model;
 ```