fix(docker): restore NEXT_PUBLIC_APP_URL build arg with dummy fallback

getBaseUrl() in lib/core/utils/urls is evaluated at module load during
next build's page-data collection and throws if NEXT_PUBLIC_APP_URL is
unset. PR #4658 removed the build arg, breaking the Docker build at the
"/_not-found" page-data collection step.

Restore the dummy localhost fallback (mirroring DATABASE_URL). The CORS
fix from #4658 is preserved: next.config.ts no longer reads
NEXT_PUBLIC_APP_URL at build time, and no module-level expression
captures getBaseUrl() — every caller invokes it at request time, where
getEnv() reads the deployed container env. The dummy localhost value
cannot leak into runtime CORS response headers.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

docker/app.Dockerfile

@@ -69,11 +69,19 @@ ENV NEXT_TELEMETRY_DISABLED=1 \
     VERCEL_TELEMETRY_DISABLED=1 \
     DOCKER_BUILD=1
 
-# Provide dummy database URLs during image build so server code that imports @sim/db
-# can be evaluated without crashing. Runtime environments should override these.
+# Provide dummy values during image build so module-eval-time validators
+# (e.g. @sim/db connection init, getBaseUrl() in lib/core/utils/urls) don't
+# crash next build during page-data collection. Runtime environments must
+# override both. NEXT_PUBLIC_APP_URL is intentionally NOT read by
+# next.config.ts at build time — response CORS is computed at request time
+# in proxy.ts via getEnv(), so the localhost fallback below cannot leak
+# into production CORS response headers.
 ARG DATABASE_URL="postgresql://user:pass@localhost:5432/dummy"
 ENV DATABASE_URL=${DATABASE_URL}
 
+ARG NEXT_PUBLIC_APP_URL="http://localhost:3000"
+ENV NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
+
 # Per-platform cache id keeps arm64/amd64 SWC artifacts isolated.
 RUN --mount=type=cache,id=next-cache-${TARGETPLATFORM},target=/app/apps/sim/.next/cache \
     --mount=type=cache,id=turbo-cache-${TARGETPLATFORM},target=/app/.turbo \