Server: no built-in public host, no trusted proxy by default; OpenAPI server variable host (D-123)

KVITT_PUBLIC_URL is required: every command refuses to start without it (compose
always sets it). KVITT_TRUSTED_PROXY defaults to none, which the rate limiter never
resolves. contracts/openapi.yaml and the utoipa document: servers[].url
https://{host}:8443 with variable host (default kvitt.example.invalid). E-7 and E-12
examples on kvitt.example.invalid.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/tests/sync_api/serve.rs

@@ -79,6 +79,7 @@ async fn rotate_epoch_sets_a_new_random_epoch_and_exits_0() {
     let output = Command::new(env!("CARGO_BIN_EXE_kvitt-server"))
         .arg("rotate-epoch")
         .env("KVITT_DATA_DIR", app.data_dir())
+        .env("KVITT_PUBLIC_URL", PUBLIC_URL)
         .env("RUST_LOG", "warn")
         .output()
         .unwrap();
@@ -96,6 +97,7 @@ fn binary(dir: &std::path::Path, bind: SocketAddr) -> Command {
     command
         .env("KVITT_DATA_DIR", dir)
         .env("KVITT_BIND", bind.to_string())
+        .env("KVITT_PUBLIC_URL", PUBLIC_URL)
         .env("KVITT_FCM_CREDENTIALS", dir.join("no-such-key.json"))
         .env("RUST_LOG", "warn");
     command