- appsettings: drop upstream's public JWT secret; API refuses to start outside Development without one
- Cors:AllowedOrigins (compose: https://SITE_DOMAIN); unset = any origin for local dev
- default admin/system/bot emails @diwan.local instead of @ganjoor.net
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>