fix(dashboard): use verified custom domain for view-as-student handoff (#677)

* fix(dashboard): use verified custom domain for view-as-student handoff

Prefer the org's verified custom domain over window.location.origin when
resolving the public tenant host. This prevents admin URLs like
app.example.com from being used for the student login-link handoff when
the org's public site is example.com.

Co-authored-by: Rotimi Best <[email protected]>

* fix(dashboard): keep self-hosted org origin on window.location

Self-hosted deployments serve admin and LMS from the same URL, so
getOrgPublicOrigin should always return window.location.origin there
rather than preferring a configured custom domain.

Co-authored-by: Rotimi Best <[email protected]>

---------

Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Rotimi Best <[email protected]>

apps/dashboard/src/lib/features/course/utils/course-preview.ts

@@ -1,7 +1,9 @@
+import { get } from 'svelte/store';
 import { goto } from '$app/navigation';
 import { resolve } from '$app/paths';
 import { snackbar } from '$features/ui/snackbar/store';
 import { accountApi } from '$features/account/api/account.svelte';
+import { currentOrg, getOrgPublicOrigin } from '$lib/utils/store/org';
 
 interface OpenCoursePreviewOptions {
   courseId: string;
@@ -21,7 +23,7 @@ export function getPublicCoursePageUrl(courseSlug: string, currentOrgDomain = ''
   }
 
   const trimmedDomain = currentOrgDomain?.trim();
-  const origin = trimmedDomain || window.location.origin;
+  const origin = trimmedDomain || getOrgPublicOrigin(get(currentOrg));
 
   return new URL(resolve(`/course/${courseSlug}`, {}), origin).toString();
 }
@@ -73,7 +75,7 @@ export async function viewAsStudent({ courseId, currentOrgDomain = '' }: ViewAsS
     return false;
   }
 
-  const origin = currentOrgDomain?.trim() || window.location.origin;
+  const origin = currentOrgDomain?.trim() || getOrgPublicOrigin(get(currentOrg));
   const loginLinkUrl = new URL('/api/auth/login-link', origin);
   loginLinkUrl.searchParams.set('token', token);
   loginLinkUrl.searchParams.set('redirect', `/courses/${courseId}/lessons?next=true`);