delete the bug-report discord webhook, and the last dead HOME_DIR reads

DISCORD_BUG_REPORT_WEBHOOK is gone, with sendToDiscord and its helpers. Reports
still land in DATA_PATH/bug-reports — the disk write always happened first and
the webhook was only a ping about it, so nothing about the report is lost.

It was a personal notification channel living in deployment config, on a platform
whose owner is the only person who files reports. It was also never in
.env.example: the setup script wrote a variable nothing documented, which is the
same drift as PORT, in the other direction.

Note DISCORD_WEBHOOK_URL is a DIFFERENT variable — the notify sidecar's own
channel — and is untouched.

Then a parity sweep of setup / .env.example / what the code reads, which turned
up two leftovers from earlier today:

HOME_DIR was still read in six files, each with its own `?? homedir()` fallback.
Dead since nothing sets it, but a dead read is worse than none — it reads as a
supported override. They take homedir() directly now. user-instance.ts gets a
comment on why its line stays where it is: it sits above `process.env.HOME =
homeDir`, and homedir() reads $HOME, so a read moved below that assignment would
return whichever member was last spawned into. Two of the six had fallback chains
ending in process.cwd() and '' — the second would have silently disabled whatever
consumed it rather than failing.

VAULTWARDEN_URL was uncommented in .env.example among the variables setup writes,
though it is a plugin variable setup has never written. Commented out with the
other plugin entries.

The three files now agree: setup writes PORT, BROWSER_RELAY_PORT and
POSTGRES_URL; .env.example lists those plus JWT_SECRET and VAULT_STORE_KEY, which
are required by code and deliberately unwritten until the secret store lands.

Not typechecked (empty node_modules, frozen installs). Every changed file parses;
the setup section was run and writes three variables.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/servers/sidecar/music/cliamp-ws.ts

@@ -20,7 +20,7 @@ const ASOUNDRC_PATH = join(import.meta.dir, 'asoundrc');
 
 // Single super user, so the owner's home is the root every path is resolved against — same convention as
 // stream-audio.ts and the indexer.
-const ROOT_DIR = process.env.HOME_DIR ?? homedir();
+const ROOT_DIR = homedir();
 
 // parec's output format IS the contract with the browser's AudioWorklet: signed 16-bit LE, 44.1kHz, stereo.
 const CAPTURE_ARGS = ['--format=s16le', '--rate=44100', '--channels=2', '-d', `${VIRTUAL_SINK}.monitor`];

src/servers/sidecar/music/indexer.ts

@@ -22,7 +22,7 @@ import { homedir } from 'node:os';
 
 import { DATA_PATH } from '../../data-path';
 
-const HOME = process.env.HOME_DIR ?? homedir();
+const HOME = homedir();
 export const MUSIC_ROOT = join(HOME, 'Music');
 const CACHE_ROOT = join(DATA_PATH, 'music', 'cache');
 const MANIFEST_PATH = join(CACHE_ROOT, 'manifest.json');

src/servers/sidecar/music/stream-audio.ts

@@ -5,7 +5,7 @@ import { homedir } from 'node:os';
 // All processing lives here (the platform is just a proxy). Files live under the owner's home — single
 // super user, so HOME_DIR. Paths from the app are home-relative (e.g. "Music/Artist/Album/track.mp3"),
 // exactly like file-browser /raw.
-const ROOT_DIR = process.env.HOME_DIR ?? homedir();
+const ROOT_DIR = homedir();
 
 const CONTENT_TYPES: Record<string, string> = {
   mp3: 'audio/mpeg',