fix(auth): resolve deduplicated OAuth callback redirects against base URL

[krzeznicki]

Fixes #3326

On self-hosted standalone deployments, request.url carries the server's internal origin (e.g. the Docker container hostname), so the deduplicated OAuth callback response redirected users to https://<container-id>:3000/welcome-redirect (ERR_NAME_NOT_RESOLVED). better-auth returns a relative Location, which only breaks when the cached (second) response absolutizes it against request.url.

• resolve cached redirects and the welcome-path fallbacks against env.NEXT_PUBLIC_BASE_URL instead of request.url
• drop the now-unused request param from createCachedRedirect
• add regression tests: a relative cached redirect and the wait-timeout path, both with an internal-origin request URL

Validation: pnpm test utils/oauth/auth-callback-deduplication.test.ts — 11 passed; the two new tests reproduced the container-origin redirect before the fix. No behavior change on Vercel, where request.url and NEXT_PUBLIC_BASE_URL share the same origin.

[vercel]

@krzeznicki is attempting to deploy a commit to the Inbox Zero OSS Program Team on Vercel.

A member of the Team first needs to authorize it.

[CLAassistant]

All committers have signed the CLA.