[Siumauricio]

Problem

• og:url on blog posts rendered as https://dokploy.com/undefined/blog/<slug>. It was built from process.env.NEXT_PUBLIC_APP_URL, which is not defined, so it became the relative path undefined/blog/... and was resolved against metadataBase.
• /blog and individual posts rendered no <link rel="canonical">.

Changes

• lib/ghost.ts: adds SITE_URL and getPostCanonicalUrl(). It uses the post's Ghost canonical_url when set; otherwise it uses https://dokploy.com/blog/<slug>. The result is always absolute and has no query string or hash, www is normalized to the bare domain, and canonicals pointing to cms.dokploy.com are ignored.
• Blog post: alternates.canonical and og:url come from that helper.
• Blog index: canonical and og:url are https://dokploy.com/blog.
• Tag pages: canonical is https://dokploy.com/blog/tag/<tag>.

Verified locally (next dev, requested with ?utm=x)

/blog                   -> canonical + og:url https://dokploy.com/blog
/blog/devops-containers -> https://dokploy.com/blog/devops-containers
/blog/enterprise-paas   -> https://dokploy.com/blog/enterprise-paas

Not in this PR (infra)

• cms.dokploy.com currently has Ghost private mode enabled. Posts return a 302 to /private/, and robots.txt is Disallow: /. Images under /content/images/ still load. The plan is to replace private mode with a 301 redirect from /<slug>/ to https://dokploy.com/blog/<slug>, set up as a Cloudflare or Ghost redirect rule.
• www.dokploy.com already returns a 301 to dokploy.com.