fix: QA hardening across desktop connect, CLI, setup, and PWA update flow (#52)

- desktop: probe-then-persist server URL — scheme-less input tries https
  then http; a failed probe no longer saves a dead URL that would trap
  the next launch in a redirect to a broken address
- frontend: close the create-collection modal on successful submit
  (backdrop stayed mounted and intercepted navigation)
- frontend: reload once on service-worker controllerchange so returning
  users don't run a stale cached shell after a deploy
- frontend: gate dashboard empty states on resource loading to stop the
  "No project selected" / "Create your workspace" flash
- cli: resolve scheduled-job refs by name or id for jobs:run, jobs:runs,
  and jobs:rm, matching bucket/org resolution
- cli: correct stale pk_live_/pk_test_ help text to the real prm_ format;
  align README command spellings and demo seed prefixes
- setup: rewrite all public URL vars (auth, vite, backend) and cookie
  domain for the entered host — https for domains, http for IPs — with
  anchored full-line substitutions so stale ports/paths can't survive
- docs: VITE_* vars never reach the frontend image build; the app
  resolves API/auth URLs same-origin at runtime, so host changes need no
  rebuild — noted HTTPS requirement for PWA/secure-context features

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

DEPLOYMENT_GUIDE.md

@@ -40,7 +40,7 @@ docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
 | `PRIMORA_ENCRYPTION_KEY` | AES-256 key (64 hex chars) for project secrets (Vault page, `secret://` job refs), integration credentials + webhook secrets at rest | production |
 | `AUTH_BASE_URL` / `BETTER_AUTH_URL` | public auth URL (`https://host/auth`) | yes |
 | `AUTH_INTERNAL_BASE_URL` | backend → auth internal URL (`http://auth:3001`) | yes |
-| `VITE_APP_URL` / `VITE_AUTH_BASE_URL` / `VITE_API_BASE_URL` | frontend public URLs — **baked into the frontend image at build time** | yes |
+| `VITE_APP_URL` / `VITE_AUTH_BASE_URL` / `VITE_API_BASE_URL` | frontend public URLs — informational only; the shipped image resolves API/auth URLs same-origin at runtime, so no rebuild is needed when the host changes | yes |
 | `BACKEND_STORAGE_ROOT` | object storage directory inside the backend container (local driver) | yes |
 | `BACKEND_STORAGE_DRIVER` | `local` (default) or `s3` — S3-compatible object storage | no |
 | `S3_ENDPOINT` / `S3_REGION` / `S3_BUCKET` | S3 API endpoint (empty endpoint → AWS `s3.<region>.amazonaws.com`), region, bucket | with `s3` |
@@ -81,8 +81,12 @@ labels:
 ```
 
 Once TLS is live, update `VITE_APP_URL`, `VITE_AUTH_BASE_URL`,
-`AUTH_BASE_URL`, `BETTER_AUTH_URL`, and `COOKIE_DOMAIN` to the https origin
-and rebuild the frontend image (`docker compose build frontend`).
+`AUTH_BASE_URL`, `BETTER_AUTH_URL`, `BACKEND_PUBLIC_URL`, and
+`COOKIE_DOMAIN` to the https origin and restart the stack
+(`docker compose up -d`). The frontend resolves API/auth URLs
+same-origin, so no image rebuild is needed — HTTPS is still required for
+PWA install, service workers, and other secure-context features on
+non-localhost origins.
 
 ## SMTP / email