Merge commit from fork
`detectOrigin` returned the auto-detected forwarded host whenever
`VERCEL`/`AUTH_TRUST_HOST` was set, ignoring an explicitly configured
`NEXTAUTH_URL`. A configured canonical URL should always win; only fall
back to the forwarded host when no `NEXTAUTH_URL` is set.
Adds unit tests for detectOrigin precedence.
