Serve the app on app.qrmaster.net, marketing on www

Splits the two hostnames across one deployment. No files move: the Next app still
serves every route on both hosts, and the middleware decides per host which paths it
owns and 301s the rest. /login and /signup stay on www - all 82 marketing CTAs point
at /signup, which carries a hard canonical to www plus ad traffic.

src/lib/hosts.ts is the single source of truth for the boundary (APP_PATH_PREFIXES,
isAppPath, wwwUrl, appUrl, urlForPath). The middleware and every absolute-URL builder
read from it so they cannot drift apart.

- Split the overloaded NEXT_PUBLIC_APP_URL into a www and an app origin. It previously
  fed both public URLs and in-app URLs, so any single value was wrong somewhere. Most
  important: QRCodeCard encodes this origin into the QR code the user downloads and
  prints, so it must stay on www.
- Route Stripe return URLs, email links and OAuth redirects per path rather than
  against one origin, so /dashboard lands on app and /pricing on www.
- Cross the host boundary once, after a successful login: the router cannot push across
  origins, so that jump needs a full load. The user arrives signed in because the
  session cookie is scoped to COOKIE_DOMAIN.
- Keep the app host out of search indexes: X-Robots-Tag on every response plus a
  Disallow-all robots.txt via rewrite, and /sitemap.xml redirects to www.
- Point the TikTok callback fallback at www explicitly. It used to read
  NEXT_PUBLIC_APP_URL, whose meaning changed here, and only the apex domain is
  verified with TikTok.

Host splitting is inert while both origins are equal, so development is unaffected.

Verified: tsc clean, production build succeeds including the Edge middleware bundle,
and the path-to-host mapping is unit-checked (prefix traps like /created and
/settings-guide stay on www, query strings do not break matching).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/app/(main)/(auth)/login/LoginClient.tsx

@@ -9,6 +9,7 @@ import { Button } from '@/components/ui/Button';
 import { useTranslation } from '@/hooks/useTranslation';
 import { useCsrf } from '@/hooks/useCsrf';
 import { appendRedirectParam, sanitizeRedirectPath } from '@/lib/auth-flow';
+import { needsHostChange, urlForPath } from '@/lib/hosts';
 
 type LoginClientProps = {
     showPageHeading?: boolean;
@@ -63,6 +64,15 @@ export default function LoginClient({ showPageHeading = true }: LoginClientProps
                 const redirectUrl = data.needsOnboarding
                     ? appendRedirectParam('/onboarding', redirectTarget)
                     : (redirectTarget || '/dashboard');
+
+                // Login lives on the marketing host, the app on app.*. The router cannot
+                // push across origins, so a host change needs a full load. The session
+                // cookie is shared via COOKIE_DOMAIN, so the user arrives signed in.
+                if (needsHostChange(redirectUrl)) {
+                    window.location.assign(urlForPath(redirectUrl));
+                    return;
+                }
+
                 router.push(redirectUrl);
                 router.refresh();
             } else {

src/app/(main)/(auth)/signup/SignupClient.tsx

@@ -9,6 +9,7 @@ import { Button } from '@/components/ui/Button';
 import { useTranslation } from '@/hooks/useTranslation';
 import { useCsrf } from '@/hooks/useCsrf';
 import { appendRedirectParam, sanitizeRedirectPath } from '@/lib/auth-flow';
+import { needsHostChange, urlForPath } from '@/lib/hosts';
 
 export default function SignupClient() {
     const router = useRouter();
@@ -48,15 +49,15 @@ export default function SignupClient() {
                 body: JSON.stringify({ name, email, password }),
             });
 
-            const data = await response.json();
-
-            if (response.ok && data.success) {
-                if (data.requiresEmailVerification) {
-                    router.push(`/verify-email?email=${encodeURIComponent(data.email)}`);
-                    return;
-                }
-
-                // Store user in localStorage for client-side
+            const data = await response.json();
+
+            if (response.ok && data.success) {
+                if (data.requiresEmailVerification) {
+                    router.push(`/verify-email?email=${encodeURIComponent(data.email)}`);
+                    return;
+                }
+
+                // Store user in localStorage for client-side
                 localStorage.setItem('user', JSON.stringify(data.user));
 
                 // Track successful signup with PostHog
@@ -76,8 +77,16 @@ export default function SignupClient() {
                     console.error('PostHog tracking error:', error);
                 }
 
-                // Redirect to onboarding
-                router.push(appendRedirectParam('/onboarding', redirectTarget));
+                // Redirect to onboarding - which lives on the app host, so this normally
+                // crosses the host boundary and cannot go through the router.
+                const onboardingUrl = appendRedirectParam('/onboarding', redirectTarget);
+
+                if (needsHostChange(onboardingUrl)) {
+                    window.location.assign(urlForPath(onboardingUrl));
+                    return;
+                }
+
+                router.push(onboardingUrl);
                 router.refresh();
             } else {
                 setError(data.error || 'Failed to create account');