fix: use public origins for SSO redirects

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/cli",
-  "version": "0.2.70",
+  "version": "0.2.71",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/cli/src/update.ts

@@ -707,6 +707,15 @@ const MIGRATIONS: Migration[] = [
       if (!ctx.dryRun) writeFileSync(file, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     },
   },
+  {
+    version: "0.2.71",
+    id: "public-forward-auth-redirect-origins",
+    description:
+      "Builds SSO redirects and returnTo URLs from configured public app origins instead of internal gateway listeners.",
+    apply() {
+      // Public URL handling improves automatically after updating and rebuilding.
+    },
+  },
 ];
 
 /** Release tooling uses this to require an explicit migration entry per version. */