Set the server's public URL from KEEPORG_EXTERNAL_URL

The image passes neither -config nor -url, so a deployment had no way to
set external_url and the server built invite links, device-approval pages
and the OIDC redirect URI on http://localhost:8765. The variable overrides
the configuration file and -url overrides it. The deployment values set it
to https://keeporg.tiredsysadmin.cc.

Also document every environment variable the server reads, and the
standard proxy and CA variables it honours for OIDC.

Server version 0.8.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/keeporgd/main.go

@@ -17,6 +17,7 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"strings"
 	"syscall"
 	"time"
 
@@ -26,6 +27,9 @@ import (
 	"cc.tiredsysadmin.keeporg/internal/store"
 )
 
+// externalURLEnv sets external_url, between the configuration file and -url.
+const externalURLEnv = "KEEPORG_EXTERNAL_URL"
+
 // Version is stamped at build time from versions.mk.
 var Version = "dev"
 
@@ -82,7 +86,7 @@ func main() {
 		configPath = flag.String("config", "", "path to a JSON configuration file")
 		addr       = flag.String("addr", "", "listen address (overrides the config file)")
 		dataDir    = flag.String("data", "", "data directory (overrides the config file)")
-		extURL     = flag.String("url", "", "externally reachable base URL (overrides the config file)")
+		extURL     = flag.String("url", "", "externally reachable base URL (overrides $"+externalURLEnv+" and the config file)")
 		masterKey  = flag.String("master-key-file", "",
 			"file holding the master key that wraps the vault keys, created if "+
 				"absent; $"+secret.MasterKeyEnv+" and $"+secret.MasterKeyFileEnv+
@@ -121,6 +125,12 @@ func main() {
 		}
 	}
 	cfg := fc.toConfig()
+	// The public URL is the one setting a deployment usually knows only at
+	// deploy time, so it can come from the environment as well. A flag
+	// still wins.
+	if v := strings.TrimSpace(os.Getenv(externalURLEnv)); v != "" {
+		cfg.ExternalURL = v
+	}
 	if *addr != "" {
 		cfg.Addr = *addr
 	}