Fix remote Agent RFS public origin

[Yuqing (mydmdm)]

Summary

• add validated HUABU_PUBLIC_ORIGIN as the canonical deployment origin for remote Agent reachback
• derive both Canvas RFS and Agentlet connection endpoints from that origin while retaining explicit loopback development fallbacks
• fail network startup for missing, loopback, unsafe, or Host-allowlist-inconsistent public origins
• remove the separate ACP_URL wrapper override and document the unified configuration

Addresses #280.

Validation

• pnpm typecheck
• pnpm format
• pnpm lint:fix (0 errors; existing repository warnings only)
• Server suite: 207 passed files, 2452 passed tests, 1 skipped file
• focused hotfix tests: 5 passed files, 36 passed tests
• sh -n bin/start-agentlet-daemon
• wrapper smoke checks for invalid scheme and HTTPS/non-default-port to WSS endpoint mapping