use the short tailnet name, not the FQDN

http://officer-dev:9000 rather than http://officer-dev.ts.pastilhas.dev:9000.
All three forms resolve inside the tailnet — short name, FQDN, raw 100.x — and
the short one is what anybody actually types. PUBLIC_URL is read by people too:
gen:index bakes it into the page's OpenGraph tags.

It depends on the tailnet's search domain, which every Tailscale client sets when
MagicDNS is on. A device that has lost it resolves the FQDN instead, and the
answer there is to type the longer one rather than to default everybody to it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/officer-setup/lib/env.sh

@@ -88,9 +88,14 @@ ENVF
 # The tailnet is where Officer is actually reached — it is the perimeter the
 # whole security model rests on — so its address is the honest default.
 #
-# MagicDNS name preferred over the raw 100.x address. Both work, but the name
+# The SHORT MagicDNS name — `officer-dev`, not `officer-dev.ts.example.dev` and
-# survives the node being re-registered and reads as something a person can type,
+# not the raw 100.x address. All three resolve inside the tailnet; the short one
-# and PUBLIC_URL ends up baked into the page's OpenGraph tags by `bun gen:index`.
+# is the one anybody actually types, and PUBLIC_URL ends up baked into the page's
+# OpenGraph tags by `bun gen:index`, so it is read by people as well as machines.
+#
+# It relies on the tailnet's search domain, which every Tailscale client sets when
+# MagicDNS is on. A device that has somehow lost it resolves the FQDN and not the
+# short name — the fix there is to type the longer one, not to default to it.
 #
 # Falls back to localhost when there is no tailnet, which is correct rather than
 # merely tolerable: a machine with no private network has no other address that
@@ -98,7 +103,8 @@ ENVF
 tailnet_hostname() {
   local dns ip
   dns="$(tailscale status --json 2>/dev/null | grep -oP '"DNSName":\s*"\K[^"]+' | head -1)"
-  dns="${dns%.}"
+  dns="${dns%.}"      # MagicDNS reports it fully qualified, with a trailing dot
+  dns="${dns%%.*}"    # and we want the short name
   if [[ -n "$dns" ]]; then
     echo "$dns"
     return 0