prefix the env with OFFICERDEV_, and keep reading the bare names

PORT, PUBLIC_URL and POSTGRES_URL are names half the software in the world
uses. Bun auto-loads .env into EVERY process started in the platform directory,
so a bare PORT reaches the sidecars, the tools they spawn and anything an agent
runs from here — and a bare POSTGRES_URL reaches things with no business
holding a database credential.

Four parts.

officer-setup now writes OFFICERDEV_-prefixed names, with the reasoning in the
generated file so whoever opens it later knows why.

Every consumer reads `OFFICERDEV_X ?? X` — eleven sites across the databases,
the DAV router, officer-url.mjs, os-user-postgres and two scripts. The bare
name is the FALLBACK, never the source, which is what makes this safe to ship
before every machine has been converted.

`bun run fix:env` converts a file in place. Idempotent, preserves comments and
`export`, leaves the value untouched including an `=` inside it, and refuses to
touch names belonging to other software — prefixing PATH or NODE_ENV does not
rename a variable, it deletes it.

And it runs on every restart from the server settings screen. There rather than
at boot because a restart is the one moment the file can be rewritten and take
effect in the same breath: the process about to start is the one that reads it.
Non-fatal, since the fallback means the worst case is that nothing changed.

gen-index reads either spelling out of the file directly, because it is run by
hand as often as by the setup and a bare shell has no .env loaded.

Verified by converting this machine's own .env: PORT, PUBLIC_URL and the
database all still resolve, gen:index still finds its URL, 1152 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/dav/router.ts

@@ -43,7 +43,7 @@ davRouter.post('/provision/ios', async (ctx) => {
 
   // The profile has to name a host, and PUBLIC_URL is the only place that knows the one a phone can
   // actually reach — the request's own Host header is whatever the reverse proxy forwarded.
-  const publicUrl = process.env.PUBLIC_URL;
+  const publicUrl = process.env.OFFICERDEV_PUBLIC_URL ?? process.env.PUBLIC_URL;
   if (!publicUrl) throw errors.INTERNAL_SERVER_ERROR('PUBLIC_URL is not set; cannot build a profile');
 
   let url: URL;

src/servers/api/server-settings/server-settings.ts

@@ -1,6 +1,7 @@
 import { createRouter } from '../../create-router';
 import { rebuildFrontend } from '../../plugins/generate';
 import { isKnownToPm2, restartProcess } from '../../app-store/pm2';
+import { fixEnvFile } from '../../env-prefix';
 import { PLATFORM_DIR } from '../../data-path';
 import { readdirSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
@@ -66,10 +67,27 @@ serverSettingsRouter.post('/restart', async (ctx) => {
     return ctx.json({ ok: false, error: 'not running under PM2 — restart it the way you started it' }, 400);
   }
 
+  // Convert `.env` to the `OFFICERDEV_` prefix on the way past.
+  //
+  // Here rather than at boot, because a restart is the one moment the file can be rewritten and the
+  // change take effect in the same breath — the process about to start is the one that reads it. Doing
+  // it at boot would rewrite a file the running process had already loaded.
+  //
+  // Idempotent and non-fatal: an already-converted file is not even written, and a failure must not stop
+  // a restart the owner asked for. Every consumer still reads the unprefixed name as a fallback, so the
+  // worst case is that nothing changed.
+  let envFixed: string[] = [];
+  try {
+    envFixed = fixEnvFile(join(PLATFORM_DIR, '.env')).changed;
+    if (envFixed.length) console.log(`[env] prefixed on restart: ${envFixed.join(', ')}`);
+  } catch (err) {
+    console.error('[env] could not prefix .env —', err instanceof Error ? err.message : err);
+  }
+
   setTimeout(() => {
     void restartProcess('officer', PLATFORM_DIR);
   }, 250);
-  return ctx.json({ ok: true, restartingIn: 250 });
+  return ctx.json({ ok: true, restartingIn: 250, envFixed });
 });
 
 serverSettingsRouter.get('/settings', async (ctx) => {