fix(prod): wire MARKETING_URL + COOKIE_DOMAIN into config template

[mastermanas805]

Why — three production regressions from PR #4

Step C of the OSS restructure (commit 66c8f59) removed an auto-swap
that papered over a misconfigured `APP_URL` on DO App Platform.
With the swap gone and the prod template never threading the new
`ServerConfig` fields, the live API now:

1. `POST /webhook/new` returns `receive_url: https://instanode.dev/webhook/receive/...\`
   — the marketing host on GitHub Pages, which returns 405 on POST.
   Verified against live: `curl -X POST https://api.instanode.dev/webhook/new\` returns a broken URL.
2. OAuth login redirects to `http://localhost:5173/dashboard.html\` —
   the default for `Server.MarketingURL` kicks in because the env var
   isn't set on DO. Every new signup lands on a dead localhost URL.
3. Dashboard upgrade button / dashboard resources response points at
   `http://localhost:5173/pricing.html\` — same cause.

Change

Add `marketing_url`, `cookie_domain`, and `allowed_origins` to
`config.prod.yaml.tpl` so envsubst populates them from DO env vars at
deploy time.

`allowed_origins` is hardcoded to the production origins (not env-driven)
because YAML-list envsubst is awkward and the prod list is stable. Change
it here if you add new frontend origins.

Deploy runbook (must do in this order)

```bash

1. (You) Rotate NEWRELIC_LICENSE_KEY in New Relic UI. Grab the new value.

Current key is sitting plaintext in DO app spec — rotate as a standalone

security fix regardless of this PR.

2. (You) Update DO env vars. Either via the UI (Apps → insta-node-lite →

Settings → App-Level Environment Variables) or doctl:

APP_ID=3fb74b82-1835-4dd1-9932-1cd49ad59cfb

Fetch current spec:

doctl apps spec get $APP_ID > /tmp/spec.current.yaml

Edit /tmp/spec.current.yaml and under services[0].envs:

- change APP_URL value to: https://api.instanode.dev

- add new entry: MARKETING_URL=https://instanode.dev (RUN_TIME, plaintext)

- add new entry: COOKIE_DOMAIN=instanode.dev (RUN_TIME, plaintext)

- replace NEWRELIC_LICENSE_KEY with the rotated value, type: SECRET

Apply:

doctl apps update $APP_ID --spec /tmp/spec.current.yaml

3. Merge this PR. DO auto-deploys on master push. Verify post-deploy:

curl -s -X POST https://api.instanode.dev/webhook/new \
-H 'Content-Type: application/json' \
-d '{"name":"verify"}' | jq .receive_url

Expected: "https://api.instanode.dev/webhook/receive/..."

(NOT the old https://instanode.dev/webhook/receive/...)

```

Test plan

• Env vars updated on DO before merge (see runbook)
• PR merges → DO auto-deploys
• Post-deploy: `/webhook/new` returns an api.instanode.dev URL
• Post-deploy: OAuth login redirects to https://instanode.dev/dashboard.html
• Post-deploy: `/api/me/resources` dashboard response has upgrade_url pointing at https://instanode.dev/pricing.html