Docker hardening + first-run fixes

docker/.env.example

@@ -7,9 +7,15 @@
 # REQUIRED: Core Settings
 # ===========================================
 
-# Your domain name (e.g., synapsis.example.com)
+# Your domain name (no scheme, no path). Example: synapsis.example.com
 DOMAIN=your-domain.com
 
+# Optional: Override node domain (host only, defaults to DOMAIN)
+# NEXT_PUBLIC_NODE_DOMAIN=your-domain.com
+
+# Optional: Public app URL for background jobs (auto-derived from node domain if unset)
+# NEXT_PUBLIC_APP_URL=https://your-domain.com
+
 # Admin email addresses (comma-separated for multiple)
 ADMIN_EMAILS=admin@your-domain.com
 
@@ -32,5 +38,8 @@ DB_NAME=synapsis
 # Or set a specific port: PORT=3000
 PORT=auto
 
+# Allow localhost domains in production (set only for local testing)
+# ALLOW_LOCALHOST=1
+
 # Maximum AI bots per user (default: 5)
 # BOT_MAX_PER_USER=5