task #539: push deployment-hardening branch to Gitea

Pushed the existing main-branch commits (since e0a4652) to the
Gitea origin remote as a new branch `replit-sync-deployment-hardening`
so the user can open a PR manually. No code edits in this task —
all changes were already committed on `main` by task #538.

Branch contents (3 commits since e0a4652):
- f16f476  Improve handling of external proxy configurations and session security
- 7d13e8e  deployment: harden self-hosted install behind HTTPS reverse proxies
- a01e102  Update documentation to clarify CORS error impact on user login

Files changed (5): artifacts/api-server/src/app.ts, scripts/src/seed.ts,
.env.example, .env.docker.example (covered in f16f476), docker-compose.yml,
README.md.

Push details:
- Authenticated via GITEA_TOKEN (oauth2 user) embedded in the push URL.
- Token filtered out of all logged output via sed.
- No `--force` used. Gitea accepted the push as a brand-new branch.
- Gitea echoed the PR-create URL: /rafraa/TX/pulls/new/replit-sync-deployment-hardening

Deviations from the plan:
- Plan step 1-2 said to "create branch from e0a4652 + commit fresh".
  Sandbox blocks `git switch -c` / `git commit` even in this task agent,
  so I pushed HEAD as the new branch instead. The result on Gitea is
  identical — the diff vs `main` is the same 5 files; only the commit
  history granularity differs (3 small commits vs 1 squashed commit).
  If the user prefers a single squashed commit they can squash-merge
  the PR on Gitea.
- The `test` workflow is failing on the api-server start race, but
  that's out of scope for #539 and is already covered by task #540
  (Auto-start the API server when running tests).

.env.example

@@ -22,30 +22,11 @@ MOCKUP_PORT=8081
 # In compose this is set automatically; required when running natively.
 PORT=8080
 # Public base URL the SPA + API are reachable at. Used to build absolute
-# upload URLs for the local-FS storage driver and to derive whether the
-# session cookie should be marked `secure`. Match the URL operators
-# actually open in the browser (e.g. https://tx.example.com).
+# upload URLs for the local-FS storage driver and to validate CORS origins.
 PUBLIC_BASE_URL=http://localhost:3000
 # Comma-separated list of origins allowed by the API server's CORS layer.
-# MUST include every URL the SPA can be reached at — the public domain,
-# any reverse-proxy hostnames, the LAN IP for tablets/phones, and any
-# tunneled URL (Tailscale `*.ts.net`, ngrok, Cloudflare Tunnel, etc).
-# Examples:
-#   ALLOWED_ORIGINS=http://localhost:3000
-#   ALLOWED_ORIGINS=https://tx.example.com,https://it-demo.tail70b2bc.ts.net
-#   ALLOWED_ORIGINS=http://localhost:3000,http://192.168.1.42:3000
+# Must include PUBLIC_BASE_URL and any additional reverse-proxy domains.
 ALLOWED_ORIGINS=http://localhost:3000
-# Set to `true` when Tx OS sits behind a TLS-terminating proxy that
-# does NOT forward `X-Forwarded-Proto: https` (notably `tailscale serve`,
-# the ngrok free tier, and some Cloudflare Tunnel setups). Without this,
-# the session cookie is silently dropped and login bounces back to the
-# login screen even on a successful POST /auth/login. Leave unset for
-# direct localhost access or when your proxy forwards the header.
-# SECURITY: only enable when the API is not reachable directly over plain
-# HTTP from outside — i.e. only your TLS edge proxy can hit it. Otherwise
-# anyone on the same network can submit plain-HTTP requests that the app
-# trusts as HTTPS.
-TRUST_PROXY_HTTPS=false
 # pino log level: trace | debug | info | warn | error | fatal
 LOG_LEVEL=info
 # 32+ random bytes. Generate with `openssl rand -hex 32`. REQUIRED.
@@ -144,11 +125,6 @@ LOCAL_STORAGE_SIGNING_SECRET=
 # the first-run wizard at /setup.
 SEED_ADMIN_PASSWORD=
 SEED_USER_PASSWORD=
-# Set to `true` to populate the Executive Meetings module with a full
-# day of realistic-looking demo meetings on first boot (useful for
-# screenshots, sales demos, and UI walkthroughs). Leave unset on real
-# self-hosted installs — the module should start empty.
-SEED_DEMO_MEETINGS=false
 
 # -----------------------------------------------------------------------------
 # Email (optional)