chore(auth): migrate keycloak base URL to auth herodevs

[v3nant]

Summary

• Replaces the hardcoded idp.prod.apps.herodevs.io default in
  auth-config.svc.ts with auth.herodevs.com/idp
• Adopts the org-recommended NES_KC_BASE / NES_KC_REALM env var.
• Preserves OAUTH_CONNECT_URL as a full-URL override for backwards
  compatibility.

Priority order in getRealmUrl():

1. OAUTH_CONNECT_URL (full URL, existing override)
2. NES_KC_BASE + NES_KC_REALM (org Actions variables)
3. Hardcoded defaults (https://auth.herodevs.com/idp + universe)

Test plan

• hd auth login completes successfully against prod (confirms
  auth.herodevs.com/idp OIDC endpoints are reachable)
• Setting OAUTH_CONNECT_URL still overrides the URL (backwards
  compat)
• Setting NES_KC_BASE + NES_KC_REALM constructs the expected
  realm URL

[dannysauer]

I think this looks alright, but I'm probably not an appropriate codeowner. :)

[jtgorny]

It looks right but that url won't be live until the 13th

[v3nant]

It looks right but that url won't be live until the 13th

got it, will be holding off the merge/deployment until then