#658 Hardcoded URLs in 20+ locations - no public config

https://highway.rodmena.app is hardcoded in 20+ files: tenant_onboard.py, invitations.py (BASE_URL), approval_email.py, welcome_email.py, security_headers.py. Should add [public] section to config.ini with base_url.