PUBLIC_URL comes back, and gen:index takes it as an argument

Removing PUBLIC_URL earlier today was wrong, and the Build section is where it
would have surfaced: gen-index.ts exits 1 without it, so `bun gen:index` fails,
index.gen.html is never written, and `bun start` has no page to serve.

It came out because origin validation was being discontinued — but that was one
of four consumers and the only one that is gone. gen-index needs it for
OpenGraph tags, which crawlers fetch standalone and cannot resolve relative;
task-api-env builds OFFICER_API_HOST from it; and dav/router hard-requires it,
https only, to build an iOS profile.

It is also the one value this machine genuinely cannot derive, which is what
separates it from DATA_PATH and the rest that left today.

gen:index now takes a URL as its first argument, ahead of the environment and
.env: `bun gen:index https://officer.example.com`. Changing the public address is
one command rather than an edit plus a regenerate, and a second address can be
generated for without touching the install's .env.

It also validates now. A relative or scheme-less value substituted silently and
produced OpenGraph tags nothing can resolve — invisible until someone shares a
link and the preview comes back blank.

.env is PORT, PUBLIC_URL, POSTGRES_URL. Verified by running the section; all
three paths through gen:index exercised (absent, valid argument, invalid).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -2,6 +2,13 @@
 PORT=9000
 POSTGRES_URL="postgres://postgres:password@localhost:5432/officer"
 
+# Where Officer is reached from a browser — the one value the machine cannot derive. Read by
+# `bun gen:index` (OpenGraph tags, which need an absolute URL), the task API host, and the CalDAV iOS
+# profile builder, which additionally requires https.
+#
+# `bun gen:index https://other.example.com` overrides it for one run without editing this file.
+PUBLIC_URL=http://localhost:9000
+
 # ── No secrets live here ───────────────────────────────────────────────────────────────────────
 # JWT_SECRET and VAULT_STORE_KEY were here until 2026-08-13. Every encryption and signing key now
 # lives in the secret store — a 0600 SQLite file at $OFFICER_ROOT/secrets/officer-keys.db, one key
@@ -15,10 +22,6 @@ POSTGRES_URL="postgres://postgres:password@localhost:5432/officer"
 # unreadable, and for the wallet seed that is unrecoverable.
 
 # ── Optional ───────────────────────────────────────────────────────────────────────────────────
-# Where Officer is reached from a browser. Read by the task API host check and the CalDAV iOS profile
-# builder — the latter is the only thing that hard-requires it, and it demands https.
-# PUBLIC_URL=https://officer.example.com
-
 # Guards (CORS origin checks, rate limits, password-strength rules) are ON unless this is set to
 # "dev" or "development". Unset is hardened, which is why officer-setup no longer writes it — set it
 # by hand, on a local machine you trust, to develop. Note that `bun dev` does NOT set it: that script