fix(canary): map PUBLIC_BASE_URL env var to canary.base_url

Spec §12.4, .env.example, .env.development, and dev.compose.yml all use the
name PUBLIC_BASE_URL for the externally-reachable URL stamped into trigger/
manage links. But the koanf env-key map in config.go only routed
CANARY_BASE_URL → canary.base_url. So setting PUBLIC_BASE_URL had no effect,
the default fallback "http://localhost:8080" silently won, and every issued
token came back with trigger_url/manage_url like
"http://localhost:8080/c/<id>" regardless of where canary was actually reachable.

Visible to the operator as: trigger/manage URLs in the SPECIMEN ISSUED dossier
pointing at :8080 (where canary doesn't even listen externally — host port is
nginx ${NGINX_HOST_PORT}, defaulting to randomised 22784).

Fix is one line: add PUBLIC_BASE_URL alongside CANARY_BASE_URL in the env-key
map. Both env names now route to canary.base_url. Backwards-compatible —
existing CANARY_BASE_URL deployments keep working.

Operator action: set `PUBLIC_BASE_URL=http://localhost:${NGINX_HOST_PORT}` in
.env.development (e.g. http://localhost:22784) and restart canary. URLs will
then reflect the actual reachable address.

PROJECTS/beginner/canary-token-generator/backend/internal/config/config.go

@@ -298,6 +298,7 @@ var envKeyMap = map[string]string{
 	"OTEL_INSECURE":                "otel.insecure",
 	"OTEL_SAMPLE_RATE":             "otel.sample_rate",
 	"CANARY_BASE_URL":              "canary.base_url",
+	"PUBLIC_BASE_URL":              "canary.base_url",
 	"CANARY_MANAGE_URL":            "canary.manage_url",
 	"TURNSTILE_SECRET_KEY":         "turnstile.secret_key",
 	"TURNSTILE_SITE_KEY":           "turnstile.site_key",