chore: smaller docker image, simplification pass on environment variables, fix direct navigation without vite

.env.example

@@ -1,32 +1,36 @@
 # ── API server ────────────────────────────────────────────────────────────────
 
-# Protocol the API server listens on (http or https)
-GERBEUR_PROTOCOL=http
+# Public-facing URL of the server. Used for CORS/WebSocket origin checks,
+# email links, and OG image URLs. Behind a reverse proxy, set this to the
+# externally-visible URL with no trailing slash (e.g. https://example.com).
+# Defaults to http://localhost:GERBEUR_PORT for local development.
+# GERBEUR_PUBLIC_URL=https://example.com
 
-# Public hostname for the API (used in generated URLs, e.g. OG image tags)
-GERBEUR_HOSTNAME=localhost
+# Site name used in OG meta tags
+GERBEUR_SITE_NAME=gerbeur
+
+# Port the API server listens on (the container's internal port)
+GERBEUR_PORT=8000
 
 # Network interface Oak binds to. Default: 0.0.0.0 (all interfaces, required for Docker).
 # Set to 127.0.0.1 to restrict to loopback only.
 GERBEUR_LISTEN_HOST=0.0.0.0
 
-# Port the API server listens on
-GERBEUR_PORT=8000
+# Base URL of the frontend, used in email links (e.g. password reset) and
+# automatically added to the CORS/WebSocket allowed-origins list.
+# Defaults to GERBEUR_PUBLIC_URL — correct for single-container deployments.
+# In prod with a separate frontend host, set this to the frontend origin; that
+# is the only variable you need for that case (no GERBEUR_ALLOWED_ORIGINS entry required).
+# Example: https://app.example.com
+# GERBEUR_FRONTEND_URL=
 
-# Comma-separated list of extra origins allowed to reach the API/WS cross-origin.
-# The server's own BASE_URL is always allowed automatically.
-# In dev: add Vite's dev server URL (check actual host/port in Vite output).
-# In prod with a separate frontend host: add that public frontend origin here.
+# Comma-separated list of *extra* origins allowed to reach the API/WS.
+# GERBEUR_PUBLIC_URL and GERBEUR_FRONTEND_URL are always included automatically.
+# Typically only needed in dev to whitelist the Vite dev server.
+# Defaults to empty (no extra origins).
 # Example: http://localhost:3000,http://127.0.0.1:3000
 GERBEUR_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
 
-# Base URL of the frontend, used in email links (e.g. password reset).
-# Defaults to the API's own BASE_URL — correct when the API serves the frontend
-# (standard single-container deployment). Override when running the frontend on
-# a separate host or port (e.g. Vite dev server or a CDN origin).
-# Example: http://localhost:3000
-# GERBEUR_FRONTEND_URL=
-
 # Secret key used to sign JWTs. Generate with: openssl rand -hex 32
 GERBEUR_JWT_SECRET=
 
@@ -44,13 +48,13 @@ GERBEUR_FROM_EMAIL=
 # Use \n for line breaks in single-line .env values, or use a quoted multiline block.
 GERBEUR_WELCOME_EMAIL_BODY="# Welcome to {{site_name}}!\n\nHi **{{username}}**,\n\nYour account has been created successfully. Welcome aboard!"
 
-# Site name used in OG meta tags
-GERBEUR_SITE_NAME=gerbeur
-
 # ── Frontend (Vite) ───────────────────────────────────────────────────────────
 # These must be prefixed with VITE_ to be exposed to the client bundle.
-# They tell the frontend where the API server is reachable from the browser.
-
-VITE_API_PROTOCOL=http
-VITE_API_HOSTNAME=localhost
-VITE_API_PORT=8000
+# Only needed when the API runs on a different host/port than the frontend.
+# In standard dev (API on :8000, Vite on :3000) these are not required —
+# the frontend automatically uses http://localhost:8000 in dev mode.
+# In prod (single container) they are not used — the frontend uses relative URLs.
+# Only set these when deploying the API and frontend on separate hosts.
+# VITE_API_PROTOCOL=https
+# VITE_API_HOSTNAME=api.example.com
+# VITE_API_PORT=443