fix(auth): build password-reset links from an operator-set public address, never the Host header (M462 #4981)

buildResetURL used r.Host and r.TLS, so a forgot-password request with a
forged Host emailed the victim a real reset token on a link to the
attacker's server. Links now come only from network_settings.public_url
(migration 0062), and no reset email is sent while it is empty; the response
stays the same opaque 200 and the log says why.

The address is set on a new "Public address" card under Admin → Integrations,
which offers the page's own origin and warns while unset. PUT
/api/admin/network-settings takes either field alone, so the proxy card and
this one can't overwrite each other.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/admin_network.go

@@ -23,10 +23,16 @@ type networkSettingsResp struct {
 	// arrived and count them rather than guess.
 	ForwardedChain string `json:"forwarded_chain"`
 	RemoteAddr     string `json:"remote_addr"`
+	// PublicURL is where users reach Minstrel; reset emails link to it and
+	// are not sent while it is empty.
+	PublicURL string `json:"public_url"`
 }
 
+// Both fields are optional so the proxy card and the public-address card can
+// each save their own value without overwriting the other's.
 type updateNetworkSettingsReq struct {
-	TrustedProxyHops int `json:"trusted_proxy_hops"`
+	TrustedProxyHops *int    `json:"trusted_proxy_hops"`
+	PublicURL        *string `json:"public_url"`
 }
 
 func (h *handlers) handleGetNetworkSettings(w http.ResponseWriter, r *http.Request) {
@@ -39,13 +45,37 @@ func (h *handlers) handleUpdateNetworkSettings(w http.ResponseWriter, r *http.Re
 		writeErr(w, apierror.BadRequest("invalid_body", "malformed JSON"))
 		return
 	}
-	if err := h.netSettings.SetHops(r.Context(), req.TrustedProxyHops); err != nil {
-		if errors.Is(err, netsettings.ErrHopsOutOfRange) {
-			writeErr(w, apierror.BadRequest("invalid_hops", err.Error()))
+	if req.TrustedProxyHops == nil && req.PublicURL == nil {
+		writeErr(w, apierror.BadRequest("invalid_body", "nothing to update"))
+		return
+	}
+	// Validate everything before writing anything, so a bad public URL can't
+	// leave the hops half-saved.
+	if req.TrustedProxyHops != nil && (*req.TrustedProxyHops < 0 || *req.TrustedProxyHops > netsettings.MaxTrustedProxyHops) {
+		writeErr(w, apierror.BadRequest("invalid_hops", netsettings.ErrHopsOutOfRange.Error()))
+		return
+	}
+	if req.PublicURL != nil {
+		if _, err := netsettings.NormalizePublicURL(*req.PublicURL); err != nil {
+			writeErr(w, apierror.BadRequest("invalid_public_url", err.Error()))
+			return
+		}
+	}
+	if req.TrustedProxyHops != nil {
+		if err := h.netSettings.SetHops(r.Context(), *req.TrustedProxyHops); err != nil {
+			if errors.Is(err, netsettings.ErrHopsOutOfRange) {
+				writeErr(w, apierror.BadRequest("invalid_hops", err.Error()))
+				return
+			}
+			writeErrWithLog(w, h.logger, "admin network: update failed", apierror.Internal(err))
+			return
+		}
+	}
+	if req.PublicURL != nil {
+		if err := h.netSettings.SetPublicURL(r.Context(), *req.PublicURL); err != nil {
+			writeErrWithLog(w, h.logger, "admin network: public URL update failed", apierror.Internal(err))
 			return
 		}
-		writeErrWithLog(w, h.logger, "admin network: update failed", apierror.Internal(err))
-		return
 	}
 	// Echo the payload recomputed under the NEW value, so the card can show
 	// immediately what the change did to this request's own address rather
@@ -61,5 +91,6 @@ func (h *handlers) networkSettingsPayload(r *http.Request) networkSettingsResp {
 		DetectedClientIP: auth.ClientIP(r, hops),
 		ForwardedChain:   r.Header.Get("X-Forwarded-For"),
 		RemoteAddr:       r.RemoteAddr,
+		PublicURL:        h.netSettings.PublicURL(),
 	}
 }