refactor(desktop): harden OAuth redirect rewrite for host variants and self-hosters

The interceptor previously matched a strict `${HOSTED_FRONTEND_URL}/*`
prefix and did a naive String.replace, which broke whenever the backend
NEXT_FRONTEND_URL differed at all (apex vs www, http vs https, or a
self-hosted domain). Now:

- Match by host: apex + www. sibling, both http and https.
- Rewrite via URL parsing so only protocol/host change; query strings
  containing the host as a value are left intact.
- Read HOSTED_FRONTEND_URL through getHostedFrontendUrl() which honors
  a SURFSENSE_HOSTED_FRONTEND_URL_OVERRIDE env var, letting self-hosters
  point their builds at their own frontend without rebuilding.

Default behavior is identical when override is unset and backend host
matches the baked-in value.

surfsense_desktop/.env.example

@@ -5,6 +5,11 @@
 # inside the desktop app. Set to your production frontend domain.
 HOSTED_FRONTEND_URL=https://surfsense.net
 
+# Runtime override for the above (read at app start, no rebuild required).
+# Useful for self-hosters whose backend NEXT_FRONTEND_URL differs from the
+# value baked into the official desktop builds. Leave empty to use HOSTED_FRONTEND_URL.
+# SURFSENSE_HOSTED_FRONTEND_URL_OVERRIDE=
+
 # PostHog analytics (leave empty to disable)
 POSTHOG_KEY=
 POSTHOG_HOST=https://assets.surfsense.com