fix(frontend): prefix auth API requests with VITE_PUBLIC_APP_URL for cross-origin Workers hosting

docs/architecture/README.md

@@ -534,7 +534,7 @@ ffmpeg -i input.mov \
 A thread-safe, JSON-persisted runtime config store lives in `backend/chat/src/config/runtime.go` and is shared with the playout service via the playlist volume (`/app/playlist/config.json`).
 
 - Editable via `GET/PUT /api/admin/config` from the admin UI.
-- Fields: `hlsSegmentDuration` (2–15s, default 6), `hlsWindowSize` (3–100, default 24), `matomoUrl`, `matomoSiteId`.
+- Fields: `hlsSegmentDuration` (2–15s, default 2), `hlsWindowSize` (3–100, default 12), `matomoUrl`, `matomoSiteId`.
 - Playout reads the same file (`loadSharedHLSConfig`) as an env fallback for HLS segment duration/window.
 - Typed setters validate values; invalid input is rejected with `400`.
 

docs/operations/cloudflare-workers-setup.md

@@ -39,24 +39,20 @@ Serve the Vite-built SPA (`frontend/dist`) as Worker static assets:
 
 See [gitea-cloudflare-workers.md](./gitea-cloudflare-workers.md) for the automated deployment workflow.
 
-### Variables and secrets
+### Build-time variables
 
-On the Worker, set the following environment variables (needed to run the frontend):
+The `VITE_PUBLIC_*` values are baked into the bundle at build time by Vite (`vite.config.ts` uses `envDir: ".."` to read them from the repo root). They are supplied by the Gitea Actions build environment from Gitea secrets — not as Worker runtime variables. The static-assets Worker has no runtime JavaScript, so it reads no `env` at request time.
 
-| Type      | Name                                   | Value                                           |
-| --------- | -------------------------------------- | ----------------------------------------------- |
-| Secret    | ADMIN_PASSWORD                         | `not-a-real-admin-password`                     |
-| Plaintext | ADMIN_SESSION_TTL_HOURS                | `12`                                            |
-| Plaintext | ADMIN_USERNAME                         | `boogers`                                       |
-| Plaintext | HLS_SEGMENT_DURATION                   | `2`                                             |
-| Plaintext | HLS_WINDOW_SIZE                        | `12`                                            |
-| Plaintext | PLAYLIST_PATH                          | `/app/playlist/playlist.txt`                    |
-| Plaintext | VITE_PUBLIC_ADMIN_DEFAULT_MODERATOR    | `boogers`                                       |
-| Plaintext | VITE_PUBLIC_ADMIN_DEFAULT_ROOM         | `main`                                          |
-| Plaintext | VITE_PUBLIC_ADMIN_MODERATION_LOG_LIMIT | `50`                                            |
-| Plaintext | VITE_PUBLIC_APP_URL                    | `https://linearvoid.tv`                         |
-| Plaintext | VITE_PUBLIC_HLS_URL                    | `https://media.linearvoid.tv/hls/playlist.m3u8` |
-| Plaintext | VITE_PUBLIC_WS_URL                     | `wss://linearvoid.tv/ws`                        |
+| Name                                     | Value                                           |
+| ---------------------------------------- | ----------------------------------------------- |
+| `VITE_PUBLIC_APP_URL`                    | `https://linearvoid.tv`                         |
+| `VITE_PUBLIC_WS_URL`                     | `wss://linearvoid.tv/ws`                        |
+| `VITE_PUBLIC_HLS_URL`                    | `https://media.linearvoid.tv/hls/playlist.m3u8` |
+| `VITE_PUBLIC_ADMIN_DEFAULT_MODERATOR`    | `boogers`                                       |
+| `VITE_PUBLIC_ADMIN_DEFAULT_ROOM`         | `main`                                          |
+| `VITE_PUBLIC_ADMIN_MODERATION_LOG_LIMIT` | `50`                                            |
+
+Backend services (playout, chat, nginx) read their own runtime variables (`ADMIN_*`, `HLS_*`, `PLAYLIST_PATH`, `R2_*`, `DATABASE_URL`, `REDIS_URL`) from the container environment — see [`.env.example`](../../.env.example).
 
 ## Custom domains
 

docs/operations/gitea-cloudflare-workers.md

@@ -58,6 +58,13 @@ jobs:
         run: cd frontend && npm ci
 
       - name: Build
+        env:
+          VITE_PUBLIC_APP_URL: ${{ secrets.VITE_PUBLIC_APP_URL }}
+          VITE_PUBLIC_WS_URL: ${{ secrets.VITE_PUBLIC_WS_URL }}
+          VITE_PUBLIC_HLS_URL: ${{ secrets.VITE_PUBLIC_HLS_URL }}
+          VITE_PUBLIC_ADMIN_DEFAULT_MODERATOR: ${{ secrets.VITE_PUBLIC_ADMIN_DEFAULT_MODERATOR }}
+          VITE_PUBLIC_ADMIN_DEFAULT_ROOM: ${{ secrets.VITE_PUBLIC_ADMIN_DEFAULT_ROOM }}
+          VITE_PUBLIC_ADMIN_MODERATION_LOG_LIMIT: "50"
         run: cd frontend && npm run build
 
       - name: Deploy to Cloudflare Workers
@@ -71,10 +78,15 @@ jobs:
 
 ## Secrets to add in Gitea
 
-| Secret                  | Value                                |
-| ----------------------- | ------------------------------------ |
-| `CLOUDFLARE_API_TOKEN`  | API token with Workers permissions   |
-| `CLOUDFLARE_ACCOUNT_ID` | Cloudflare account ID from dashboard |
+| Secret                                | Value                                |
+| ------------------------------------- | ------------------------------------ |
+| `CLOUDFLARE_API_TOKEN`                | API token with Workers permissions   |
+| `CLOUDFLARE_ACCOUNT_ID`               | Cloudflare account ID from dashboard |
+| `VITE_PUBLIC_APP_URL`                 | Public viewer URL                    |
+| `VITE_PUBLIC_WS_URL`                  | WebSocket endpoint                   |
+| `VITE_PUBLIC_HLS_URL`                 | HLS playlist URL                     |
+| `VITE_PUBLIC_ADMIN_DEFAULT_MODERATOR` | Default moderator username           |
+| `VITE_PUBLIC_ADMIN_DEFAULT_ROOM`      | Default chat room                    |
 
 ## Verify deployment