fix(auth): derive canonical Supabase JWT issuer

[orga-agent]

Summary

• derive the GoTrue JWT issuer as the canonical Supabase Auth base ending in /auth/v1
• share the issuer derivation with the JWKS endpoint builder so signing and verification URLs cannot drift
• add a deployment-level regression test for root-domain externalURL values

Root cause

The operator explicitly rendered GOTRUE_JWT_ISSUER as the normalized project externalURL, while consumers derive the standard Supabase issuer as <externalURL>/auth/v1. Fresh ES256 sessions were therefore rejected by Gateway with token has invalid issuer.

Verification

• go test ./internal/resources/deployments ./internal/resources/common -count=1
• make test test-tanka test-delivery
• make lint

Deployment remains a separate manual step after merge.