fix(ui-server-auth): trust new Go backend origin (#2043)

## Summary
- trust the new Railway Go backend in the standalone Auth UI
- preserve exact-origin validation for untrusted redirects
- document the root cause, delivery plan, and production validation path

## Root cause
The Auth UI rejected
`api_server_url=https://airi-server-next.up.railway.app`, fell back to
the legacy API, and surfaced `Load failed` at the browser CORS boundary.

## Test plan
- focused bootstrap-context tests: 6/6
- complete Auth UI suite: 27/27
- `vue-tsc --noEmit`
- production Vite build
- emitted bundle contains the exact new backend origin

apps/ui-server-auth/src/modules/server-auth-context.ts

@@ -17,6 +17,7 @@ const API_SERVER_URL_QUERY_PARAM = 'api_server_url'
 const TRUSTED_STANDALONE_API_SERVER_ORIGINS = [
   'https://api.airi.build',
   'https://airi-server-dev.up.railway.app',
+  'https://airi-server-next.up.railway.app',
 ]
 
 const TRUSTED_HTTPS_API_SERVER_HOSTS = new Map(