fix(portal): add invitation links and correct customer login routing

backend/src/utils/portalUrl.ts

@@ -0,0 +1,29 @@
+type PortalUrlSettings = {
+    portalDomain?: string | null
+    publicUrl?: string
+    apiBaseUrl?: string
+}
+
+/** Use deployment configuration, never request headers, for links sent by email. */
+export function getPortalLoginUrl({ portalDomain, publicUrl, apiBaseUrl }: PortalUrlSettings) {
+    const domain = portalDomain?.trim()
+    const candidates = [
+        { value: domain ? (/^https?:\/\//i.test(domain) ? domain : `https://${domain}`) : undefined },
+        { value: publicUrl?.trim() },
+        { value: apiBaseUrl?.trim(), originOnly: true },
+    ]
+
+    for (const { value, originOnly } of candidates) {
+        if (!value) continue
+        try {
+            const url = new URL(value)
+            if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) continue
+            url.pathname = `${originOnly ? "" : url.pathname.replace(/\/+$/, "")}/login`
+            url.search = ""
+            url.hash = ""
+            return url.toString()
+        } catch { /* Try the next configured address. */ }
+    }
+
+    throw new Error("Für die Portal-Einladung fehlt eine gültige öffentliche FEDEO-Adresse.")
+}