Self-host: the dashboard's links point at the install, never at coderhelm.com - #227

Summary

The dashboard's links point at the install it runs in, never at coderhelm.com. On a self-hosted install, the API keys and plugins pages called the hosted API, the API keys page told people to use https://api.coderhelm.com, and the GitHub App buttons opened CoderHelm's hosted app. Paired with CoderHelm/coderhelm-platform#312, which adds the /auth/github/app redirect these buttons use.

Changes

• lib/api-keys.ts and lib/plugins.ts: call apiBase() from the runtime config, not NEXT_PUBLIC_API_URL or api.coderhelm.com.
• API keys page: the "How keys work" address and the curl example show apiOrigin(), the install's own API.
• GitHub App links (Settings, then GitHub; Repositories; the "app was removed" screen): githubAppUrl() sends them to the install's /auth/github/app, which redirects to the install's own app on GitHub (with state for a new installation, or an installation's settings).
• The legacy platform-admin fallback (admin@coderhelm.com, for gateways before the platform_admin field) applies on the hosted dashboard only.
• scripts/no-hosted-links.mjs, run by npm run lint: fails on new hardcoded app., api., stream. or auth.coderhelm.com, the marketing site or github.com/apps/coderhelm in src/, outside lib/runtime-config.ts.
• e2e/selfhost-links.spec.ts: with a self-host runtime config, the API keys, Repositories and GitHub pages show and call only the install, and have no coderhelm.com links other than docs.coderhelm.com. It runs in the self-host build job too.

Verification

• npm run lint (UI lint and the new check), npm run typecheck: pass.
• Self-host build (no API URL baked in), as CI's self-host job: selfhost, google-analytics and selfhost-links specs, 25 passed (after rebasing onto Talk to us about moving from CoderHelm cloud to self-host #225, Docs: tables that read on a phone, and settings as definition lists #226 and Settings, System, Models: switch how a self-hosted install calls Claude, and show when an update needs model access #230).
• Touched specs against the hosted-style build (API keys, plugins, integrations, settings, shell, models, hybrid, selfhost-links): 191 passed.
• no-hosted-links allows components/google-analytics.tsx: its app.coderhelm.com is the hostname check that keeps analytics off every other host, not a link.
• Full e2e suite against the hosted-style static build: 1019 passed, 10 skipped (before rebasing onto main; lint, typecheck and the API contract check rerun after).