fix: use hybrid sidebar links for LAN and public access

Keep LAN/Tailscale-home behavior for NAS-targeted links while converting remote :8443 URLs to standard HTTPS on public access so external links resolve correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dashboard/frontend/src/components/Sidebar.svelte

@@ -169,9 +169,28 @@
     handleDragEnd();
   }
 
+  function toPublicHttpsUrl(href) {
+    if (typeof window === "undefined") return href;
+    if (!href) return href;
+
+    const isStandardHttps = location.protocol === "https:" && (!location.port || location.port === "443");
+    if (!isStandardHttps) return href;
+
+    try {
+      const url = new URL(href);
+      if (url.protocol === "https:" && url.port === "8443") {
+        url.port = "";
+        return url.toString();
+      }
+      return href;
+    } catch {
+      return href;
+    }
+  }
+
   function extHref(svc) {
     if (lanReachable && svc.port) return `http://${LAN_IP}:${svc.port}`;
-    if (svc.remoteHref) return svc.remoteHref;
+    if (svc.remoteHref) return lanReachable ? svc.remoteHref : toPublicHttpsUrl(svc.remoteHref);
     if (svc.port) {
       const host = /^\d+\.\d+\.\d+\.\d+$/.test(location.hostname) ? location.hostname : TS_IP;
       return `http://${host}:${svc.port}`;