scripts: make the light installs localhost-native, and stop relaxing guards for it

A light install is reached at localhost on the machine running it, so PUBLIC_URL
has exactly one right answer. setup.sh required it with a re-prompt loop; under
the light profile it now defaults to http://localhost:$PORT. The macOS installer
already did this — this is parity, and it removes the one prompt in a light run
whose answer a non-technical user could not be expected to produce.

setup_mac_light.sh also wrote PUBLIC_BUILD_ENV="development", justified in a
comment as "what makes plain http://localhost work". That is no longer true, and
the cost of it is not small. IS_DEV_BUILD gates exactly three things:

  origin validation   already off regardless — ALLOW_ANY_ORIGIN defaults to true
  password rules      validatePassword is skipped entirely on change-password
  rate limiting       the limiter returns next() before doing anything

So the only live effects were losing the last two, for a benefit that another
default already provided. It now writes "production", matching setup.sh. Nothing
about localhost needed relaxing: browsers treat http://localhost as a secure
context, so passkeys, getUserMedia and the clipboard all work over plain HTTP,
and passkeys in particular derive their RP ID from the request origin rather
than a configured domain.

That last point is the boundary worth knowing: http://192.168.x.x is NOT a
secure context, so reaching a light install from another device means putting
an HTTPS proxy in front of it. Recorded in the comments at both prompts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup_mac_light.sh

@@ -365,9 +365,10 @@ ENV_PUBLIC_URL=""
 if [ "$WRITE_ENV" = "1" ]; then
   echo ""
   ask ENV_PORT "PORT" "9010"
-  # PUBLIC_BUILD_ENV=development makes IS_DEV_BUILD true, which short-circuits origin validation
-  # (isOriginAllowed returns true immediately) and relaxes rate limits and password rules. That is
-  # what makes plain http://localhost work with no HTTPS reverse proxy in front.
+  # Plain http://localhost needs nothing relaxed to work: browsers treat it as a secure context, so
+  # passkeys, microphone capture and the clipboard are all available without TLS, and origin checking
+  # is already off by default (ALLOW_ANY_ORIGIN). Reaching this from another device is the case that
+  # needs an HTTPS proxy — http://192.168.x.x is not a secure context and those APIs fail there.
   ask ENV_PUBLIC_URL "PUBLIC_URL" "http://localhost:$ENV_PORT"
   ask ENV_DATA_PATH "DATA_PATH" "$HOME/.local/data"
   ask ENV_ITEMS_DIR "OFFICER_ITEMS_DIR" "$(dirname "$PROJECT_DIR")/officer-items"
@@ -385,7 +386,7 @@ if [ "$WRITE_ENV" = "1" ]; then
 PORT="$ENV_PORT"
 JWT_SECRET="$JWT_SECRET"
 PUBLIC_URL="$ENV_PUBLIC_URL"
-PUBLIC_BUILD_ENV="development"
+PUBLIC_BUILD_ENV="production"
 DATA_PATH="$ENV_DATA_PATH"
 OFFICER_ITEMS_DIR="$ENV_ITEMS_DIR"
 HOME_DIR="$HOME"