fix(auth): return 503 when NEXT_PUBLIC_APP_URL unset for invite redirectTo

Prevent invite emails from falling back to localhost when NEXT_PUBLIC_APP_URL
is unset in production. Now explicitly checks and rejects with 503.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/admin/users/route.ts

@@ -60,7 +60,13 @@ export async function POST(request: NextRequest) {
       )
     newUserId = created.user.id
   } else {
-    const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? 'http://localhost:3000'
+    const appUrl = (process.env.NEXT_PUBLIC_APP_URL ?? '').replace(/\/$/, '')
+    if (!appUrl) {
+      return NextResponse.json(
+        { error: 'Invite unavailable: NEXT_PUBLIC_APP_URL not configured' },
+        { status: 503 },
+      )
+    }
     const { data: invited, error: inviteError } = await admin.auth.admin.inviteUserByEmail(email, {
       data: { full_name: body.name ?? '' },
       redirectTo: `${appUrl}/api/auth/callback`,