server: allowed origin from PUBLIC_URL; repoint web assets to the new domain

origin-validation: the production web origin now reads from PUBLIC_URL (.env), e.g.
https://officer.pastilhas.dev, instead of a hardcoded domain; drop alpha.officer.dev.
officer-web/index.html: point og:image/favicon/manifest/etc. at the new domain (served
locally from public/).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/_middlewares/origin-validation.ts

@@ -1,11 +1,20 @@
 import type { MiddlewareHandler } from 'hono';
 import * as errors from '../custom-errors';
 
-const { PUBLIC_BUILD_ENV, EXPO_PUBLIC_CLIENT_ORIGIN } = process.env;
+const { PUBLIC_BUILD_ENV, PUBLIC_URL, EXPO_PUBLIC_CLIENT_ORIGIN } = process.env;
+
+// The allowed production web origin comes from PUBLIC_URL in .env (e.g. https://officer.pastilhas.dev),
+// not a hardcoded domain.
+const PUBLIC_ORIGIN = (() => {
+  try {
+    return PUBLIC_URL ? new URL(PUBLIC_URL).origin : undefined;
+  } catch {
+    return undefined;
+  }
+})();
 
 const WEB_ORIGINS: Record<string, string[]> = {
-  alpha: ['https://alpha.officer.dev'],
-  production: ['https://app.officer.dev', 'https://edge.officer.dev'],
+  production: PUBLIC_ORIGIN ? [PUBLIC_ORIGIN] : [],
 };
 
 const CHROME_EXTENSIONS: string[] = [