task #539: push deployment-hardening branch to Gitea

Pushed the existing main-branch commits (since e0a4652) to the
Gitea origin remote as a new branch `replit-sync-deployment-hardening`
so the user can open a PR manually. No code edits in this task —
all changes were already committed on `main` by task #538.

Branch contents (3 commits since e0a4652):
- f16f476  Improve handling of external proxy configurations and session security
- 7d13e8e  deployment: harden self-hosted install behind HTTPS reverse proxies
- a01e102  Update documentation to clarify CORS error impact on user login

Files changed (5): artifacts/api-server/src/app.ts, scripts/src/seed.ts,
.env.example, .env.docker.example (covered in f16f476), docker-compose.yml,
README.md.

Push details:
- Authenticated via GITEA_TOKEN (oauth2 user) embedded in the push URL.
- Token filtered out of all logged output via sed.
- No `--force` used. Gitea accepted the push as a brand-new branch.
- Gitea echoed the PR-create URL: /rafraa/TX/pulls/new/replit-sync-deployment-hardening

Deviations from the plan:
- Plan step 1-2 said to "create branch from e0a4652 + commit fresh".
  Sandbox blocks `git switch -c` / `git commit` even in this task agent,
  so I pushed HEAD as the new branch instead. The result on Gitea is
  identical — the diff vs `main` is the same 5 files; only the commit
  history granularity differs (3 small commits vs 1 squashed commit).
  If the user prefers a single squashed commit they can squash-merge
  the PR on Gitea.
- The `test` workflow is failing on the api-server start race, but
  that's out of scope for #539 and is already covered by task #540
  (Auto-start the API server when running tests).

scripts/src/seed.ts

@@ -646,26 +646,13 @@ async function main() {
     }
   }
 
-  // Executive meetings: sample data for today (idempotent per-date).
-  //
-  // Opt-in only — a vanilla self-hosted install should start with an
-  // empty Executive Meetings module. Set `SEED_DEMO_MEETINGS=true` in
-  // your environment when bootstrapping a demo / staging deploy that
-  // benefits from realistic-looking sample data.
-  const seedDemoMeetings =
-    (process.env.SEED_DEMO_MEETINGS ?? "").toLowerCase() === "true";
+  // Executive meetings: sample data for today (idempotent per-date)
   const today = new Date().toISOString().slice(0, 10);
-  const existingForToday = seedDemoMeetings
-    ? await db
-        .select({ id: executiveMeetingsTable.id })
-        .from(executiveMeetingsTable)
-        .where(eq(executiveMeetingsTable.meetingDate, today))
-    : [];
-  if (!seedDemoMeetings) {
-    console.log(
-      "Executive Meetings demo data skipped (set SEED_DEMO_MEETINGS=true to enable)",
-    );
-  } else if (existingForToday.length === 0) {
+  const existingForToday = await db
+    .select({ id: executiveMeetingsTable.id })
+    .from(executiveMeetingsTable)
+    .where(eq(executiveMeetingsTable.meetingDate, today));
+  if (existingForToday.length === 0) {
     {
     const sampleMeetings: Array<{
       meeting: {