fix(docker): add SUPABASE_INTERNAL_URL for server-side Supabase access

Server-side code (proxy.ts, SSR, API routes) now uses SUPABASE_INTERNAL_URL
(http://supabase-kong:8000) instead of the external domain. This avoids
hairpin NAT / DNS resolution issues where Docker containers can't reach
their own external domain through the reverse proxy.

Browser-side JS still uses the external URL (baked at build time).

packages/supabase/src/get-supabase-client-keys.ts

@@ -2,8 +2,18 @@ import * as z from 'zod';
 
 /**
  * Returns and validates the Supabase client keys from the environment.
+ *
+ * On the server, prefers SUPABASE_INTERNAL_URL (Docker-internal)
+ * over NEXT_PUBLIC_SUPABASE_URL (external domain) to avoid
+ * hairpin NAT / DNS issues in containerized deployments.
  */
 export function getSupabaseClientKeys() {
+  const isServer = typeof window === 'undefined';
+
+  const url = isServer
+    ? (process.env.SUPABASE_INTERNAL_URL || process.env.NEXT_PUBLIC_SUPABASE_URL)
+    : process.env.NEXT_PUBLIC_SUPABASE_URL;
+
   return z
     .object({
       url: z.string({
@@ -14,7 +24,7 @@ export function getSupabaseClientKeys() {
       }),
     })
     .parse({
-      url: process.env.NEXT_PUBLIC_SUPABASE_URL,
+      url,
       publicKey: process.env.NEXT_PUBLIC_SUPABASE_PUBLIC_KEY,
     });
 }