prefix the env with OFFICERDEV_, and keep reading the bare names

PORT, PUBLIC_URL and POSTGRES_URL are names half the software in the world
uses. Bun auto-loads .env into EVERY process started in the platform directory,
so a bare PORT reaches the sidecars, the tools they spawn and anything an agent
runs from here — and a bare POSTGRES_URL reaches things with no business
holding a database credential.

Four parts.

officer-setup now writes OFFICERDEV_-prefixed names, with the reasoning in the
generated file so whoever opens it later knows why.

Every consumer reads `OFFICERDEV_X ?? X` — eleven sites across the databases,
the DAV router, officer-url.mjs, os-user-postgres and two scripts. The bare
name is the FALLBACK, never the source, which is what makes this safe to ship
before every machine has been converted.

`bun run fix:env` converts a file in place. Idempotent, preserves comments and
`export`, leaves the value untouched including an `=` inside it, and refuses to
touch names belonging to other software — prefixing PATH or NODE_ENV does not
rename a variable, it deletes it.

And it runs on every restart from the server settings screen. There rather than
at boot because a restart is the one moment the file can be rewritten and take
effect in the same breath: the process about to start is the one that reads it.
Non-fatal, since the fallback means the worst case is that nothing changed.

gen-index reads either spelling out of the file directly, because it is run by
hand as often as by the setup and a bare shell has no .env loaded.

Verified by converting this machine's own .env: PORT, PUBLIC_URL and the
database all still resolve, gen:index still finds its URL, 1152 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/os-user-postgres.ts

@@ -223,7 +223,7 @@ const TEMPLATE_ISOLATION_SQL = [
  * their side.
  */
 export async function ensureTemplateIsolation(): Promise<{ ok: true } | { ok: false; error: string }> {
-  const url = process.env.POSTGRES_URL;
+  const url = (process.env.OFFICERDEV_POSTGRES_URL ?? process.env.POSTGRES_URL);
   if (!url) return { ok: false, error: 'POSTGRES_URL is not set' };
 
   let target: string;
@@ -315,7 +315,7 @@ export async function provisionPostgresRole(params: {
     }
 
     if (passwordSet && password) {
-      const { host, port } = pgpassTarget(process.env.POSTGRES_URL);
+      const { host, port } = pgpassTarget((process.env.OFFICERDEV_POSTGRES_URL ?? process.env.POSTGRES_URL));
 
       // Written twice, on purpose, and they are not redundant.
       //
@@ -428,7 +428,7 @@ const DB_NAME_RE = /^[a-zA-Z0-9._-]{1,63}$/;
 export async function dropPostgresRole(osUser: string): Promise<DropRoleResult> {
   if (!ROLE_NAME_RE.test(osUser)) return { ok: false, error: `'${osUser}' is not a usable Postgres role name` };
 
-  const url = process.env.POSTGRES_URL;
+  const url = (process.env.OFFICERDEV_POSTGRES_URL ?? process.env.POSTGRES_URL);
   if (!url) return { ok: false, error: 'POSTGRES_URL is not set' };
 
   try {