Resolve the examiner link host instead of defaulting to localhost

[vikrantwiz02]

Thesis examiners were being mailed links to http://localhost:5173, which nobody outside a developer's machine can open.

Cause. The links were built from getattr(settings, 'FRONTEND_URL', 'http://localhost:5173'), and in settings/common.py that value is read only from the process environment:

FRONTEND_URL = os.environ.get('FRONTEND_URL', 'http://localhost:5173')

Nothing in the project loads a .env file, so editing a settings file on a deployment cannot change it — only an exported variable can. These mails also go out from the background task in tasks.py, which does not necessarily inherit the web server's environment, so even an exported variable is not enough on its own. DEBUG is no guard either, since it is left true in the production settings module.

Fix. frontend_base_url() in academic_procedures/utils.py resolves in order: an exported FRONTEND_URL, then the domain registered in the sites table, then the previous default with a logged warning so the next misconfiguration is visible rather than silent. A bare domain gets https, unless it is localhost. All four link builders in the file use it — invitation accept and reject, the review form, and the reminder.

Verified each branch of the resolver, restoring the site row afterwards:

Condition	Resolved base
no variable, site domain registered	the institute host over https
variable exported	the exported value, trailing slash trimmed
site domain still example.com	previous default, warning logged
site domain is localhost	http, not https

Rendering the real templates produces /thesis-invitation/<token>/accept, /thesis-invitation/<token>/reject and /thesis-evaluation/<token> against the institute host, which match the routes the client declares in App.jsx. Local development is unchanged: exporting FRONTEND_URL=http://localhost:5173 takes precedence.

Not touched: three link builders in academic_procedures/admin.py fall back to http://localhost:8000 via a SITE_URL setting that is not defined anywhere. Those are backend URLs built with reverse() and the backend is served on a different port from the client, so they need a separate decision rather than this resolver.