Prod: public origin gupi.glitch.university, internal services over HTTP

CORS_ORIGIN defaults to https://gupi.${DOMAIN} (the TLS frontend served by the
proxy); the app still reaches Postgres/MinIO by their docker hostnames over
plain HTTP on the shared network. Clarify the split in .env.prod.example and
fix the deploy success URL.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.prod.example

@@ -1,9 +1,13 @@
-# GUPI production environment. Copy to /opt/gupi/.env.prod on the server and fill in.
-# GUPI runs ONLY its own app container; Postgres + MinIO come from the shared gu_common
-# stack (which must already be up). These values point the app at those services.
+# GUPI production environment TEMPLATE. Copy to /opt/gupi/.env.prod on the server and
+# fill in real values there (never commit real secrets). GUPI runs ONLY its own app
+# container; Postgres + MinIO come from the shared gu_common stack (must already be up).
 #
-# Deploy with:  ./deploy.sh
-# (which runs, on the server, from /opt/gupi:)
+# Endpoints:
+#   - Public (frontend, TLS via the proxy):  https://gupi.glitch.university
+#   - Internal (app -> services, plain HTTP): docker hostnames gnommo-db / gnommo-minio
+#     (those hostnames live in docker-compose.prod.yml; here you only set credentials).
+#
+# Deploy with:  ./deploy.sh   (server-side it runs, from /opt/gupi:)
 #   docker compose -f /opt/gupi/docker-compose.prod.yml --env-file /opt/gupi/.env.prod up -d
 
 # --- Shared PostgreSQL (gu_common; reachable as gnommo-db on the shared network) ---
@@ -18,7 +22,10 @@ S3_REGION=us-east-1
 OSINT_S3_BUCKET=gupi-osint
 
 # --- App ---
+# DOMAIN drives the default public origin (https://gupi.${DOMAIN}); override CORS_ORIGIN
+# directly if the frontend is served somewhere else.
 DOMAIN=glitch.university
+# CORS_ORIGIN=https://gupi.glitch.university
 JWT_SECRET=CHANGE_ME_LONG_RANDOM_SECRET
 LEVEL_EDITING_ENABLED=false
 MAX_DOCUMENT_BYTES=26214400