feat(portal): allow PORTAL_APEX_HOSTS env to extend APEX_HOSTS

Hardcoded apex list is fine while breakpilot.com is the only target
but blocks deploying the portal under any other hostname. Adds a
comma-separated PORTAL_APEX_HOSTS env that prepends extras to the
default list (longest-first so the suffix-strip loop stays correct).

Needed today to deploy at portal-dev.meghsakha.com without forking
the codebase per environment. The default list still covers dev
(localhost) and prod (breakpilot.com, stage.breakpilot.com).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/lib/host.ts

@@ -11,7 +11,20 @@ export type HostMatch =
   | { kind: "unknown" };
 
 // Longest-first so `stage.breakpilot.com` is matched before `breakpilot.com`.
-const APEX_HOSTS = ["stage.breakpilot.com", "breakpilot.com", "localhost"];
+// Built-ins cover dev (localhost) + the canonical breakpilot.com targets.
+// PORTAL_APEX_HOSTS is a comma-separated env override for per-environment
+// hosts (e.g. portal-dev.meghsakha.com while breakpilot.com isn't registered).
+const APEX_HOSTS = (() => {
+  const base = ["stage.breakpilot.com", "breakpilot.com", "localhost"];
+  const extra = (process.env.PORTAL_APEX_HOSTS ?? "")
+    .split(",")
+    .map((h) => h.trim().toLowerCase())
+    .filter(Boolean);
+  // Longest-first to keep the suffix-strip loop correct.
+  return Array.from(new Set([...extra, ...base])).sort(
+    (a, b) => b.length - a.length,
+  );
+})();
 const APEX_SET = new Set(APEX_HOSTS);
 
 export function parseHost(host: string | null | undefined): HostMatch {