fix(frontend): guard metadataBase against undefined BASE_URL

Root cause of the SSG/page-data build crash: src/app/layout.tsx evaluated
new URL(process.env.BASE_URL) at module load. BASE_URL was never set as a
build-time ENV, so it was undefined -> ERR_INVALID_URL, input: 'undefined'.
Because this is the root layout, its metadata is collected for every route,
explaining why both /impressum (marketing) and /portal-login (non-marketing)
failed identically. The earlier NextAuth/middleware/force-dynamic fixes could
not help because metadata evaluation happens before any of that.

- layout.tsx: fall back to http://localhost:3000 when BASE_URL is unset
- Dockerfile: add BASE_URL build-time placeholder (matches AUTH_URL pattern)

cannamanage-frontend/Dockerfile

@@ -20,6 +20,7 @@ ENV AUTH_SECRET=build-time-placeholder-secret-minimum-32-characters
 ENV NEXTAUTH_SECRET=build-time-placeholder-secret-minimum-32-characters
 ENV AUTH_TRUST_HOST=1
 ENV BACKEND_URL=http://localhost:8080
+ENV BASE_URL=http://localhost:3000
 RUN pnpm build
 
 FROM base AS runner