Harden getSiteOrigin to use request headers (x-forwarded-host/host) and safe production fallback; remove duplicate getOrigin helpers in routes to prevent localhost:3003 redirect_uri after Google login

app/api/auth/google/route.ts

@@ -4,6 +4,7 @@ import {
   buildGoogleAuthUrl,
   createOAuthState,
   isGoogleOAuthConfigured,
+  getSiteOrigin,
 } from '@/infrastructure/auth/google-oauth';
 import {
   getOAuthReturnCookieName,
@@ -16,7 +17,7 @@ const OAUTH_STATE_COOKIE = 'shahi_google_oauth_state';
 
 export async function GET(request: Request) {
   if (!isGoogleOAuthConfigured()) {
-    return NextResponse.redirect(new URL('/login?tab=customer&error=google_not_configured', getOrigin(request)));
+    return NextResponse.redirect(new URL('/login?tab=customer&error=google_not_configured', getSiteOrigin(request)));
   }
 
   const url = new URL(request.url);
@@ -42,15 +43,3 @@ export async function GET(request: Request) {
   return NextResponse.redirect(buildGoogleAuthUrl(state, request));
 }
 
-function getOrigin(req?: Request): string {
-  if (req) {
-    try {
-      const url = new URL(req.url);
-      if (process.env.NODE_ENV === 'production' && url.protocol === 'http:') {
-        url.protocol = 'https:';
-      }
-      return url.origin;
-    } catch {}
-  }
-  return process.env.NEXT_PUBLIC_SITE_URL ?? 'https://shahikitchen.se';
-}