fix(frontend): prefix auth API requests with VITE_PUBLIC_APP_URL for cross-origin Workers hosting

docs/operations/cloudflare-workers-setup.md

@@ -39,24 +39,20 @@ Serve the Vite-built SPA (`frontend/dist`) as Worker static assets:
 
 See [gitea-cloudflare-workers.md](./gitea-cloudflare-workers.md) for the automated deployment workflow.
 
-### Variables and secrets
+### Build-time variables
 
-On the Worker, set the following environment variables (needed to run the frontend):
+The `VITE_PUBLIC_*` values are baked into the bundle at build time by Vite (`vite.config.ts` uses `envDir: ".."` to read them from the repo root). They are supplied by the Gitea Actions build environment from Gitea secrets — not as Worker runtime variables. The static-assets Worker has no runtime JavaScript, so it reads no `env` at request time.
 
-| Type      | Name                                   | Value                                           |
-| --------- | -------------------------------------- | ----------------------------------------------- |
-| Secret    | ADMIN_PASSWORD                         | `not-a-real-admin-password`                     |
-| Plaintext | ADMIN_SESSION_TTL_HOURS                | `12`                                            |
-| Plaintext | ADMIN_USERNAME                         | `boogers`                                       |
-| Plaintext | HLS_SEGMENT_DURATION                   | `2`                                             |
-| Plaintext | HLS_WINDOW_SIZE                        | `12`                                            |
-| Plaintext | PLAYLIST_PATH                          | `/app/playlist/playlist.txt`                    |
-| Plaintext | VITE_PUBLIC_ADMIN_DEFAULT_MODERATOR    | `boogers`                                       |
-| Plaintext | VITE_PUBLIC_ADMIN_DEFAULT_ROOM         | `main`                                          |
-| Plaintext | VITE_PUBLIC_ADMIN_MODERATION_LOG_LIMIT | `50`                                            |
-| Plaintext | VITE_PUBLIC_APP_URL                    | `https://linearvoid.tv`                         |
-| Plaintext | VITE_PUBLIC_HLS_URL                    | `https://media.linearvoid.tv/hls/playlist.m3u8` |
-| Plaintext | VITE_PUBLIC_WS_URL                     | `wss://linearvoid.tv/ws`                        |
+| Name                                     | Value                                           |
+| ---------------------------------------- | ----------------------------------------------- |
+| `VITE_PUBLIC_APP_URL`                    | `https://linearvoid.tv`                         |
+| `VITE_PUBLIC_WS_URL`                     | `wss://linearvoid.tv/ws`                        |
+| `VITE_PUBLIC_HLS_URL`                    | `https://media.linearvoid.tv/hls/playlist.m3u8` |
+| `VITE_PUBLIC_ADMIN_DEFAULT_MODERATOR`    | `boogers`                                       |
+| `VITE_PUBLIC_ADMIN_DEFAULT_ROOM`         | `main`                                          |
+| `VITE_PUBLIC_ADMIN_MODERATION_LOG_LIMIT` | `50`                                            |
+
+Backend services (playout, chat, nginx) read their own runtime variables (`ADMIN_*`, `HLS_*`, `PLAYLIST_PATH`, `R2_*`, `DATABASE_URL`, `REDIS_URL`) from the container environment — see [`.env.example`](../../.env.example).
 
 ## Custom domains