OCI clients (podman, docker) require an absolute URL in the
WWW-Authenticate realm. Derive it from the request Host header
so it works behind any proxy. Add service_name to rift config.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>