fix: use public origins for SSO redirects

packages/helpers/src/index.ts

@@ -6,6 +6,7 @@
  */
 
 import type { Context } from "@wrnexus/core";
+import { currentAppOrigin } from "./workspace.ts";
 
 export type RequestContext = Pick<Context, "req" | "url">;
 
@@ -127,7 +128,7 @@ export function redirectToLogin(
   loginUrl: string | URL,
   options: LoginRedirectOptions = {},
 ): Response {
-  const target = new URL(loginUrl, ctx.url.origin);
+  const target = new URL(loginUrl, `${currentAppOrigin() ?? ctx.url.origin}/`);
   if (target.protocol !== "http:" && target.protocol !== "https:") {
     throw new TypeError("Login URL must use http or https");
   }