fix(auth): route admin/customer Telegram QR login to the shared auth origin

AUTH_API_URL was wired to ApiConfigService.getBaseUrl() (the per-tenant
content origin, e.g. api.gorbushka.market), so admin/customer QR-login
session creation POSTed to a host with no /users/sessions route.

Auth is a single shared cross-tenant service (like payment's
qr.vitanova.network), not tenant-scoped - confirmed against the
pre-tenant-refactor state (commit a59ffbca) where every brand's
environment file carried the identical fixed authApiUrl, and against a
live POST to users.vitanova.network:456/users/sessions.

Restores authApiUrl as a fixed constant in both environment files and
wires AUTH_API_URL/MARKETPLACES_AUTH_CONFIG.apiUrl to it, mirroring the
existing qrApiUrl/provideMarketplacesPayment pattern. Also provides
MARKETPLACES_AUTH_CONFIG.marketplaceDomain via TenantResolverService's
existing getBaseDomain() so the X-Marketplace-Domain header stays
normalized instead of falling back to raw, unnormalized
location.hostname (it was never provided before, so that fallback was
always in effect).

No package edits, no path/method/body change, no QR/Telegram flow
change. tenantApiTemplate/tenantApiBaseUrls/ApiConfigService/
TenantResolverService untouched - still drive content-API resolution
only.

Known remaining blocker (server-side, tracked in vitanovaPackages
BACKEND-TODO.md): users.vitanova.network:456 CORS-rejects the
admin.gorbushka.market origin outright (403 on preflight, no allow
headers) while novo.market gets a full grant - this fix alone will not
make browser login work on gorbushka domains until that origin
allowlist is updated.

src/environments/environment.production.ts

@@ -11,6 +11,7 @@ export const environment = {
   theme: 'dexar',
   apiUrl: '/api',
     qrApiUrl: 'https://qr.vitanova.network/api',
+    authApiUrl: 'https://users.vitanova.network:456',
   logo: '/icons/icon-192x192.png',
   contactEmail: 'info@dexarmarket.ru',
   supportEmail: 'info@dexarmarket.ru',

src/environments/environment.ts

@@ -12,6 +12,7 @@ export const environment = {
   theme: 'dexar',
   apiUrl: '/api',
     qrApiUrl: 'https://qr.vitanova.network/api',
+    authApiUrl: 'https://users.vitanova.network:456',
   logo: '/icons/icon-192x192.png',
   contactEmail: 'info@dexarmarket.ru',
   supportEmail: 'info@dexarmarket.ru',