fix(frontend): guard metadataBase against undefined BASE_URL

Root cause of the SSG/page-data build crash: src/app/layout.tsx evaluated
new URL(process.env.BASE_URL) at module load. BASE_URL was never set as a
build-time ENV, so it was undefined -> ERR_INVALID_URL, input: 'undefined'.
Because this is the root layout, its metadata is collected for every route,
explaining why both /impressum (marketing) and /portal-login (non-marketing)
failed identically. The earlier NextAuth/middleware/force-dynamic fixes could
not help because metadata evaluation happens before any of that.

- layout.tsx: fall back to http://localhost:3000 when BASE_URL is unset
- Dockerfile: add BASE_URL build-time placeholder (matches AUTH_URL pattern)

cannamanage-frontend/Dockerfile

@@ -20,6 +20,7 @@ ENV AUTH_SECRET=build-time-placeholder-secret-minimum-32-characters
 ENV NEXTAUTH_SECRET=build-time-placeholder-secret-minimum-32-characters
 ENV AUTH_TRUST_HOST=1
 ENV BACKEND_URL=http://localhost:8080
+ENV BASE_URL=http://localhost:3000
 RUN pnpm build
 
 FROM base AS runner

cannamanage-frontend/src/app/layout.tsx

@@ -22,7 +22,10 @@ export const metadata: Metadata = {
     default: "CannaManage",
   },
   description: "Cannabis club management platform — CannaManage",
-  metadataBase: new URL(process.env.BASE_URL as string),
+  // Guard against undefined BASE_URL: `new URL(undefined)` throws ERR_INVALID_URL
+  // during Next.js "Collecting page data" (root layout metadata is evaluated for
+  // every route). Falls back to localhost; real value injected at runtime via env.
+  metadataBase: new URL(process.env.BASE_URL ?? "http://localhost:3000"),
   manifest: "/manifest.json",
   themeColor: "#2ECC71",
   appleWebApp: {