fix(whoop): redirect to NEXT_PUBLIC_APP_URL after OAuth callback

req.url reflects the dev server bind host (0.0.0.0) and forwarded
protocol when proxied through a tunnel, producing broken Location
headers like https://0.0.0.0:3000/whoop?connected=1. Use the
configured public origin instead.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: egebese

app/api/whoop/callback/route.ts

@@ -16,10 +16,13 @@ export async function GET(req: NextRequest) {
   }
   jar.delete("lt_whoop_state");
 
+  const origin =
+    process.env.NEXT_PUBLIC_APP_URL?.replace(/\/$/, "") ?? new URL(req.url).origin;
+
   try {
     const tok = await exchangeCode(code);
     await saveTokens(ctx.user.id, tok);
-    return NextResponse.redirect(new URL("/whoop?connected=1", req.url));
+    return NextResponse.redirect(`${origin}/whoop?connected=1`);
   } catch (e) {
     return NextResponse.json({ error: "exchange_failed", detail: String(e) }, { status: 500 });
   }