Server: no built-in public host, no trusted proxy by default; OpenAPI server variable host (D-123)

KVITT_PUBLIC_URL is required: every command refuses to start without it (compose
always sets it). KVITT_TRUSTED_PROXY defaults to none, which the rate limiter never
resolves. contracts/openapi.yaml and the utoipa document: servers[].url
https://{host}:8443 with variable host (default kvitt.example.invalid). E-7 and E-12
examples on kvitt.example.invalid.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

contracts/examples/E-12-create-invite/response.json

@@ -3,7 +3,7 @@
   "kind": "partner",
   "target_user_id": null,
   "code": "4N8RVT2KW6ZC",
-  "link": "https://icehack.asuscomm.com:8443/i/4N8RVT2KW6ZC?from=Jacob",
+  "link": "https://kvitt.example.invalid:8443/i/4N8RVT2KW6ZC?from=Jacob",
   "created_at": "2026-10-17T06:30:02.004Z",
   "expires_at": "2026-10-20T06:30:02.004Z"
 }

contracts/examples/E-7-me/response.json

@@ -39,5 +39,5 @@
       "server_version": 16
     }
   ],
-  "public_url": "https://icehack.asuscomm.com:8443"
+  "public_url": "https://kvitt.example.invalid:8443"
 }