- Replace redis:7-alpine with Dragonfly (Redis-protocol compatible; go-redis
client unchanged) in root, infra, and backend-dev compose files. Bounded
defaults --proactor_threads/--maxmemory so it boots on small VPSs.
- Frontend now defaults to same-origin API calls; nginx proxies /api/* to the
backend (WebSocket-aware, docker DNS resolver for upstream re-resolution).
Removes the baked localhost:8082 that broke installs reached by IP/domain.
- /auth/bootstrap returns configured OAuth providers; the UI hides
GitHub/Google buttons unless real credentials exist. Self-hosted stays
email/password only - OAuth reserved for a future managed offering.
- Sidecar ignores PLACEHOLDER_* OAuth credentials and trusts same-host
origins dynamically (Origin host == request Host) so remote installs pass
origin checks without config; cross-origin requests still rejected.
- install.sh writes ENVIRONMENT=production; COOKIE_SECURE=false in
production is now a startup warning instead of fatal (plain-HTTP installs).
- Bootstrap failure surfaces an error notice instead of silently rendering
the sign-in page.
Authored By: TDvorak <[email protected]>
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
