Fix OAuth token exchange: use internal URL, add error logging

The server-to-server token exchange was hitting the external URL
(https://account.rose-ash.com/...) which can fail from inside Docker
due to DNS/hairpin NAT. Now uses INTERNAL_URL_ACCOUNT (already set in
both docker-compose files) for the POST. Adds logging at all three
failure points so silent redirects are diagnosable.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

l1/app/config.py

@@ -64,6 +64,11 @@ class Settings:
         default_factory=lambda: os.environ.get("SECRET_KEY", "change-me-in-production")
     )
 
+    # Internal account URL for server-to-server token exchange (avoids external DNS/TLS)
+    internal_account_url: str = field(
+        default_factory=lambda: os.environ.get("INTERNAL_URL_ACCOUNT", "")
+    )
+
     # GPU/Streaming settings
     streaming_gpu_persist: bool = field(
         default_factory=lambda: os.environ.get("STREAMING_GPU_PERSIST", "0") == "1"