chore: use request Host header for download links, not BASE_URL

internal/handlers/file.go

@@ -412,16 +412,28 @@ func (h *FileHandler) SendDownloadLink(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Build the download URL using BASE_URL.
+	// Build the download URL using the request's Host header (most reliable),
+	// falling back to BASE_URL env var.
+	scheme := "https"
+	host := r.Host
 	baseURL := os.Getenv("BASE_URL")
-	if baseURL == "" {
+	if host == "" && baseURL != "" {
-		baseURL = "http://localhost:8080"
+		// Parse scheme and host from BASE_URL as fallback.
+		if strings.HasPrefix(baseURL, "https://") {
+			host = strings.TrimPrefix(baseURL, "https://")
+		} else if strings.HasPrefix(baseURL, "http://") {
+			scheme = "http"
+			host = strings.TrimPrefix(baseURL, "http://")
+		}
+	}
+	if host == "" {
+		host = "localhost:8080"
 	}
 	safeName := sanitiseFilename(event.Name)
 	if safeName == "" {
 		safeName = "report"
 	}
-	link := fmt.Sprintf("%s/dl/%s/%s.zip", strings.TrimRight(baseURL, "/"), token, safeName)
+	link := fmt.Sprintf("%s://%s/dl/%s/%s.zip", scheme, host, token, safeName)
 
 	subject := "Expense report: " + event.Name
 	body := fmt.Sprintf("Expense report for %s is ready.\n\nDownload: %s\n\nThis link expires in 24 hours.", event.Name, link)