Fix Docker signup and document deploy, migrate, and rebuild flow.

Use FormData and server-side sign-in after register, trust proxy origins for reverse-proxy deploys, pass public URL build args in Docker, and clarify that git pull plus up -d --build is required to ship code and run pending migrations.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -1,6 +1,17 @@
 # beenvoice-web environment
+#
 # Local dev:  cp .env.example .env.local
 # Docker:     cp .env.example .env
+#
+# Docker deploy checklist:
+#   1. Set AUTH_SECRET, BETTER_AUTH_URL, NEXT_PUBLIC_APP_URL to your public URL
+#   2. docker compose build --no-cache app   # NEXT_PUBLIC_* is baked in at build
+#   3. docker compose up -d --build          # migrations run on app container start
+#
+# Updating: git pull && docker compose up -d --build
+#   (git pull alone does not rebuild; up -d without --build keeps the old image)
+#
+# Migrations are idempotent — only pending SQL files are applied on each start.
 
 # Runtime
 NODE_ENV=production
@@ -9,9 +20,11 @@ WEB_PORT=3000
 # Auth
 # Generate with: openssl rand -base64 32
 AUTH_SECRET=change-me-generate-a-real-secret
+# Must match the URL users open in the browser (include https:// and port if non-standard).
 BETTER_AUTH_URL=http://localhost:3000
 
-# Public app URL
+# Public app URL — baked into the client bundle at Docker build time.
+# Set this to the same value as BETTER_AUTH_URL before `docker compose build`.
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 
 # Postgres used by docker-compose.yml