Use absolute realm URL in WWW-Authenticate and add service_name

OCI clients (podman, docker) require an absolute URL in the
WWW-Authenticate realm. Derive it from the request Host header
so it works behind any proxy. Add service_name to rift config.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/routes_test.go

@@ -55,7 +55,7 @@ func TestRoutesV2Unauthenticated(t *testing.T) {
 	}
 
 	wwwAuth := rec.Header().Get("WWW-Authenticate")
-	want := `Bearer realm="/v2/token",service="mcr-test"`
+	want := `Bearer realm="https://example.com/v2/token",service="mcr-test"`
 	if wwwAuth != want {
 		t.Fatalf("WWW-Authenticate: got %q, want %q", wwwAuth, want)
 	}