VITE_OAUTH_TOKEN_URL build-time default overrides runtime config when not explicitly set

## Description

When running the Docker image with a custom `VITE_POLARIS_API_URL`, the app still uses `http://polaris:8181` as the OAuth token endpoint unless `VITE_OAUTH_TOKEN_URL` is also explicitly passed at runtime.

## Root cause

The Dockerfile sets `ENV VITE_OAUTH_TOKEN_URL=http://polaris:8181/api/catalog/v1/oauth/tokens` during the build stage. Vite bakes this into `import.meta.env.VITE_OAUTH_TOKEN_URL` in the JS bundle.

`generate-config.sh` writes an empty string for `VITE_OAUTH_TOKEN_URL` when it is not passed at runtime. The `getConfig()` function in `src/lib/config.ts` skips empty strings in `window.APP_CONFIG` and falls through to `import.meta.env` — which returns the baked-in `polaris:8181` default.

```typescript
// src/lib/config.ts
function getConfig(key: keyof AppConfig, defaultValue: string = ""): string {
const runtimeValue = window.APP_CONFIG?.[key]
if (runtimeValue !== undefined && runtimeValue !== "") { // empty string is skipped
return runtimeValue
}
const buildTimeValue = import.meta.env[key] // falls through to baked-in default
...
}
```

## Expected behavior

If `VITE_OAUTH_TOKEN_URL` is not set at runtime, it should be derived from `VITE_POLARIS_API_URL` at runtime — not from the build-time Dockerfile default.

## Steps to reproduce

```bash
docker run -p 8080:8080 \
-e VITE_POLARIS_API_URL=http://myhost:8181 \
-e VITE_POLARIS_REALM=myrealm \
-e VITE_POLARIS_PRINCIPAL_SCOPE=PRINCIPAL_ROLE:ALL \
apache/polaris-console:latest
```

Login fails with `ERR_NAME_NOT_RESOLVED` for `polaris:8181/api/catalog/v1/oauth/tokens` despite `VITE_POLARIS_API_URL` being correctly set.

## Workaround

Always pass `VITE_OAUTH_TOKEN_URL` explicitly:

```bash
docker run -p 8080:8080 \
-e VITE_POLARIS_API_URL=http://myhost:8181 \
-e VITE_OAUTH_TOKEN_URL=http://myhost:8181/api/catalog/v1/oauth/tokens \
apache/polaris-console:latest
```

## Suggested fix

In `docker/generate-config.sh`, derive `VITE_OAUTH_TOKEN_URL` from `VITE_POLARIS_API_URL` when not explicitly set:

```bash
VITE_OAUTH_TOKEN_URL="${VITE_OAUTH_TOKEN_URL:-${VITE_POLARIS_API_URL}/api/catalog/v1/oauth/tokens}"
```

This ensures the token URL always follows the API URL unless explicitly overridden.

Start with docker/generate-config.sh, then inspect src/lib/config.ts and the Dockerfile build-stage environment setting. Run the Docker reproduction with only VITE_POLARIS_API_URL configured and verify the generated runtime configuration produces a token endpoint based on that API URL; confirm the explicit VITE_OAUTH_TOKEN_URL override still works.

Written by the indexing model from the issue text.