scripts: make the light installs localhost-native, and stop relaxing guards for it

A light install is reached at localhost on the machine running it, so PUBLIC_URL
has exactly one right answer. setup.sh required it with a re-prompt loop; under
the light profile it now defaults to http://localhost:$PORT. The macOS installer
already did this — this is parity, and it removes the one prompt in a light run
whose answer a non-technical user could not be expected to produce.

setup_mac_light.sh also wrote PUBLIC_BUILD_ENV="development", justified in a
comment as "what makes plain http://localhost work". That is no longer true, and
the cost of it is not small. IS_DEV_BUILD gates exactly three things:

  origin validation   already off regardless — ALLOW_ANY_ORIGIN defaults to true
  password rules      validatePassword is skipped entirely on change-password
  rate limiting       the limiter returns next() before doing anything

So the only live effects were losing the last two, for a benefit that another
default already provided. It now writes "production", matching setup.sh. Nothing
about localhost needed relaxing: browsers treat http://localhost as a secure
context, so passkeys, getUserMedia and the clipboard all work over plain HTTP,
and passkeys in particular derive their RP ID from the request origin rather
than a configured domain.

That last point is the boundary worth knowing: http://192.168.x.x is NOT a
secure context, so reaching a light install from another device means putting
an HTTPS proxy in front of it. Recorded in the comments at both prompts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup.sh

@@ -888,13 +888,25 @@ if [ "$GENERATE_ENV" = true ]; then
   read -r ENV_PORT
   ENV_PORT="${ENV_PORT:-9010}"
 
-  echo -n "  PUBLIC_URL (required): "
-  read -r ENV_PUBLIC_URL
-  while [ -z "$ENV_PUBLIC_URL" ]; do
-    warn "PUBLIC_URL is required"
-    echo -n "  PUBLIC_URL: "
+  # A light install is reached at localhost on the machine running it, so there is exactly one right
+  # answer and no reason to make someone produce it. Plain HTTP is fine there: browsers treat
+  # http://localhost as a secure context, so passkeys, microphone capture and the clipboard all work
+  # without TLS. That stops being true over the LAN — http://192.168.x.x is NOT a secure context and
+  # those APIs fail in browser-specific ways — so reaching a light install from another device means
+  # putting an HTTPS proxy in front of it.
+  if is_light; then
+    echo -n "  PUBLIC_URL [http://localhost:$ENV_PORT]: "
     read -r ENV_PUBLIC_URL
-  done
+    ENV_PUBLIC_URL="${ENV_PUBLIC_URL:-http://localhost:$ENV_PORT}"
+  else
+    echo -n "  PUBLIC_URL (required): "
+    read -r ENV_PUBLIC_URL
+    while [ -z "$ENV_PUBLIC_URL" ]; do
+      warn "PUBLIC_URL is required"
+      echo -n "  PUBLIC_URL: "
+      read -r ENV_PUBLIC_URL
+    done
+  fi
 
   echo -n "  DATA_PATH [$REAL_HOME/.local/data]: "
   read -r ENV_DATA_PATH