fix(deploy): require every credential, and give sandbox its own domain

Three things review caught, and one shape correction.

**No credential has a default any more.** The compose file shipped
`ADMIN_SHARED_SECRET` falling back to a value written in this repository —
and that header bypasses token verification entirely, so anyone reading
the file could act as an operator against any deployment that had not
overridden it. A default is worth less than it looks here: the deployment
that never set the variable is exactly the one where the default is public.
Every credential now comes from `.env`, and compose refuses to start naming
the variable it wanted. That also takes the last literal password out of a
tracked file.

**The origin ports are on loopback.** Both services speak plain HTTP and
mark no cookie `Secure`, because both expect to sit behind something that
terminates TLS. Published on every interface they were a way to reach the
issuer around that proxy, with sign-in codes and tokens in clear text.

**Mail settings are passed through rather than fixed.** The issuer was
pinned to printing sign-in codes to its log, and the three delivery
settings never reached it — so the documented way to configure mail could
not work, and every code and recipient went to the container log instead.
Printing codes is now asked for in `.env` like everything else, and with
nothing configured the issuer refuses to send rather than logging.

**Sandbox becomes a domain rather than a prefix.** `api.sandbox.nestri.io`
and `auth.sandbox.nestri.io`, because sandbox holds whatever is not
production and that set grows. One certificate for `*.sandbox.nestri.io`
then covers all of it, including unpredictable per-pull-request names,
and cannot be presented for production's own domain — which the zone-wide
wildcard the previous shape leaned on could.

Also drops `STEAM_API_KEY`. It was declared in two type definitions and
read by nothing: linking an account makes no outbound call that needs it.

.env.example

@@ -1,4 +1,14 @@
-# Local development database (docker compose up postgres)
+# Copy to `.env` before `docker compose up`. Compose reads every credential
+# from here and has no defaults of its own — it refuses to start naming the
+# variable it wanted rather than falling back to a value that would be public.
+
+# The local database. Throwaway values are fine; these three are what compose
+# creates the container with and what it builds DATABASE_URL from.
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=postgres
+POSTGRES_DB=nestri
+
+# For anything run outside a container — `bun dev`, `bun run db:migrate`.
 DATABASE_URL=postgres://postgres:postgres@localhost:5432/nestri
 
 # Isolated database for tests. Required by DB-backed tests; unset tests fail.
@@ -10,15 +20,14 @@ AUTH_ISSUER_URL=http://localhost:1337
 # public name is unroutable from where the API runs; docker compose sets it.
 AUTH_INTERNAL_URL=
 
-# Linking a Steam account
-STEAM_API_KEY=
-
-# Operator access to the API
+# Turns any request carrying it into an operator, so generate one rather than
+# typing something: `openssl rand -hex 32`.
 ADMIN_SHARED_SECRET=
 
 # Mail delivery. All three together, or none of them plus EMAIL_DEV_LOG=true,
-# which prints sign-in codes to the log instead of sending them.
+# which prints sign-in codes to the log instead of sending them. Printing them
+# is a local-development convenience and nothing else.
 EMAIL_SEND_URL=
 EMAIL_API_KEY=
 EMAIL_FROM=
-EMAIL_DEV_LOG=
+EMAIL_DEV_LOG=true