scripts: make the light installs localhost-native, and stop relaxing guards for it

A light install is reached at localhost on the machine running it, so PUBLIC_URL
has exactly one right answer. setup.sh required it with a re-prompt loop; under
the light profile it now defaults to http://localhost:$PORT. The macOS installer
already did this — this is parity, and it removes the one prompt in a light run
whose answer a non-technical user could not be expected to produce.

setup_mac_light.sh also wrote PUBLIC_BUILD_ENV="development", justified in a
comment as "what makes plain http://localhost work". That is no longer true, and
the cost of it is not small. IS_DEV_BUILD gates exactly three things:

  origin validation   already off regardless — ALLOW_ANY_ORIGIN defaults to true
  password rules      validatePassword is skipped entirely on change-password
  rate limiting       the limiter returns next() before doing anything

So the only live effects were losing the last two, for a benefit that another
default already provided. It now writes "production", matching setup.sh. Nothing
about localhost needed relaxing: browsers treat http://localhost as a secure
context, so passkeys, getUserMedia and the clipboard all work over plain HTTP,
and passkeys in particular derive their RP ID from the request origin rather
than a configured domain.

That last point is the boundary worth knowing: http://192.168.x.x is NOT a
secure context, so reaching a light install from another device means putting
an HTTPS proxy in front of it. Recorded in the comments at both prompts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup.sh

@@ -888,13 +888,25 @@ if [ "$GENERATE_ENV" = true ]; then
   read -r ENV_PORT
   ENV_PORT="${ENV_PORT:-9010}"
 
-  echo -n "  PUBLIC_URL (required): "
+  # A light install is reached at localhost on the machine running it, so there is exactly one right
-  read -r ENV_PUBLIC_URL
+  # answer and no reason to make someone produce it. Plain HTTP is fine there: browsers treat
-  while [ -z "$ENV_PUBLIC_URL" ]; do
+  # http://localhost as a secure context, so passkeys, microphone capture and the clipboard all work
-    warn "PUBLIC_URL is required"
+  # without TLS. That stops being true over the LAN — http://192.168.x.x is NOT a secure context and
-    echo -n "  PUBLIC_URL: "
+  # those APIs fail in browser-specific ways — so reaching a light install from another device means
+  # putting an HTTPS proxy in front of it.
+  if is_light; then
+    echo -n "  PUBLIC_URL [http://localhost:$ENV_PORT]: "
     read -r ENV_PUBLIC_URL
-  done
+    ENV_PUBLIC_URL="${ENV_PUBLIC_URL:-http://localhost:$ENV_PORT}"
+  else
+    echo -n "  PUBLIC_URL (required): "
+    read -r ENV_PUBLIC_URL
+    while [ -z "$ENV_PUBLIC_URL" ]; do
+      warn "PUBLIC_URL is required"
+      echo -n "  PUBLIC_URL: "
+      read -r ENV_PUBLIC_URL
+    done
+  fi
 
   echo -n "  DATA_PATH [$REAL_HOME/.local/data]: "
   read -r ENV_DATA_PATH

scripts/setup_mac_light.sh

@@ -365,9 +365,10 @@ ENV_PUBLIC_URL=""
 if [ "$WRITE_ENV" = "1" ]; then
   echo ""
   ask ENV_PORT "PORT" "9010"
-  # PUBLIC_BUILD_ENV=development makes IS_DEV_BUILD true, which short-circuits origin validation
+  # Plain http://localhost needs nothing relaxed to work: browsers treat it as a secure context, so
-  # (isOriginAllowed returns true immediately) and relaxes rate limits and password rules. That is
+  # passkeys, microphone capture and the clipboard are all available without TLS, and origin checking
-  # what makes plain http://localhost work with no HTTPS reverse proxy in front.
+  # is already off by default (ALLOW_ANY_ORIGIN). Reaching this from another device is the case that
+  # needs an HTTPS proxy — http://192.168.x.x is not a secure context and those APIs fail there.
   ask ENV_PUBLIC_URL "PUBLIC_URL" "http://localhost:$ENV_PORT"
   ask ENV_DATA_PATH "DATA_PATH" "$HOME/.local/data"
   ask ENV_ITEMS_DIR "OFFICER_ITEMS_DIR" "$(dirname "$PROJECT_DIR")/officer-items"
@@ -385,7 +386,7 @@ if [ "$WRITE_ENV" = "1" ]; then
 PORT="$ENV_PORT"
 JWT_SECRET="$JWT_SECRET"
 PUBLIC_URL="$ENV_PUBLIC_URL"
-PUBLIC_BUILD_ENV="development"
+PUBLIC_BUILD_ENV="production"
 DATA_PATH="$ENV_DATA_PATH"
 OFFICER_ITEMS_DIR="$ENV_ITEMS_DIR"
 HOME_DIR="$HOME"